{"resources":{"ai":{"id":"ai","name":"ai","fields":{"model":{"name":"model","type":"\u001bai.model","title":"AI Model","desc":"Single locally cached AI model. The `name` field identifies the model and `source` indicates which tool cached it (for example `\"ollama\"`, `\"huggingface\"`, `\"lmstudio\"`, `\"gpt4all\"`, `\"pytorch\"`, `\"keras\"`, `\"tfhub\"`, or `\"jan\"`). Use `ai.models.where(source == \"ollama\")` to filter by source, or inspect `size` and `modifiedAt` to find the largest or most recently used models on the system.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"models":{"name":"models","type":"\u0019\u001bai.model","title":"All locally cached AI models across all supported sources","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"AI Model Cache","desc":"Locally cached AI models discovered from tools such as Ollama, Hugging Face Hub, LM Studio, GPT4All, PyTorch Hub, Keras, TensorFlow Hub, and Jan. Iterate `models` to audit which AI models are present on the system, their sizes, file formats, publishers, and licenses.","min_provider_version":"13.16.9","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"ai.model":{"id":"ai.model","name":"ai.model","fields":{"architecture":{"name":"architecture","type":"\u0007","is_mandatory":true,"title":"Model architecture","desc":"For example LlamaForCausalLM, MistralForCausalLM, or llama.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Short description of the model","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"Base architecture family (e.g., \"llama\", \"qwen2\", \"bert\", \"mixtral\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"format":{"name":"format","type":"\u0007","is_mandatory":true,"title":"Model file format (gguf, safetensors, pytorch, h5, savedmodel, mlx, onnx, keras)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"license":{"name":"license","type":"\u0007","is_mandatory":true,"title":"License identifier if available (e.g., \"apache-2.0\", \"llama3\", \"MIT\")","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modifiedAt":{"name":"modifiedAt","type":"\t","is_mandatory":true,"title":"Last modification time","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Model name (e.g., \"llama3:latest\", \"meta-llama/Llama-2-7b-hf\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parameterSize":{"name":"parameterSize","type":"\u0007","is_mandatory":true,"title":"Human-readable parameter count","desc":"For example 7B, 13B, or 70B.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the model","provider":"go.mondoo.com/cnquery/v9/providers/os"},"quantization":{"name":"quantization","type":"\u0007","is_mandatory":true,"title":"Quantization method or level","desc":"For example Q4_K_M, Q8_0, F16, gptq, or awq.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"size":{"name":"size","type":"\u0005","is_mandatory":true,"title":"Total size in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Source tool that cached this model (ollama, huggingface, lmstudio, gpt4all, pytorch, keras, tfhub, jan)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags associated with the model","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vendor":{"name":"vendor","type":"\u0007","is_mandatory":true,"title":"Publisher or organization that released the model (e.g., \"meta-llama\", \"google\", \"mistralai\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Model version identifier (e.g., Ollama tag name, HuggingFace revision hash)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"AI Model","desc":"Single locally cached AI model. The `name` field identifies the model and `source` indicates which tool cached it (for example `\"ollama\"`, `\"huggingface\"`, `\"lmstudio\"`, `\"gpt4all\"`, `\"pytorch\"`, `\"keras\"`, `\"tfhub\"`, or `\"jan\"`). Use `ai.models.where(source == \"ollama\")` to filter by source, or inspect `size` and `modifiedAt` to find the largest or most recently used models on the system.","private":true,"min_provider_version":"13.16.9","defaults":"name source","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"antigravity":{"id":"antigravity","name":"antigravity","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Antigravity configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bantigravity.skill","title":"Antigravity skill","desc":"A single SKILL.md definition discovered for the Antigravity agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bantigravity.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Antigravity (Google) instance","desc":"Antigravity, Google's agentic development platform, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .gemini/antigravity in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://antigravity.google/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"antigravity.skill":{"id":"antigravity.skill","name":"antigravity.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Antigravity skill","desc":"A single SKILL.md definition discovered for the Antigravity agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"apache2":{"id":"apache2","name":"apache2","fields":{"conf":{"name":"conf","type":"\u001bapache2.conf","title":"Apache2 HTTP Server configuration","desc":"Parsed Apache configuration covering flat directives, loaded modules, virtual hosts, and Directory / Location access-control blocks, merged across the main config and every Include fragment. Also surfaces hardening-relevant settings such as ServerTokens, ServerSignature, TraceEnable, and response security headers. Pass `init(path: \"...\")` to point at a non-default config file.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"version":{"name":"version","type":"\u0007","title":"Apache2 version (e.g., \"2.4.62\")","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Apache2 HTTP Server","desc":"Apache HTTP Server daemon version as reported by the apache2/httpd binary. Use apache2.conf for the parsed configuration, including directives, loaded modules, virtual hosts, and access-control blocks.","min_provider_version":"11.8.14","provider":"go.mondoo.com/cnquery/v9/providers/os"},"apache2.conf":{"id":"apache2.conf","name":"apache2.conf","fields":{"directories":{"name":"directories","type":"\u0019\u001bapache2.conf.directory","refs":["\"file\""],"title":"Directory blocks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"directory":{"name":"directory","type":"\u001bapache2.conf.directory","title":"Apache2 Directory block","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"envvars":{"name":"envvars","type":"\u001bapache2.conf.envvars","title":"Environment variables sourced by Apache at startup (e.g. Debian's /etc/apache2/envvars)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","title":"Primary configuration file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bfile","refs":["\"file\""],"title":"All configuration files (main + included fragments)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"listenAddresses":{"name":"listenAddresses","type":"\u0019\u0007","refs":["\"params\""],"title":"Listen addresses/ports","provider":"go.mondoo.com/cnquery/v9/providers/os"},"location":{"name":"location","type":"\u001bapache2.conf.location","title":"Apache2 \u003cLocation\u003e block: URL-space access rules","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"locations":{"name":"locations","type":"\u0019\u001bapache2.conf.location","refs":["\"file\""],"title":"\u003cLocation\u003e blocks (URL-space access rules)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"module":{"name":"module","type":"\u001bapache2.conf.module","title":"Apache2 loaded module","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"modules":{"name":"modules","type":"\u0019\u001bapache2.conf.module","refs":["\"file\""],"title":"Loaded modules (LoadModule directives)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"file\""],"title":"Flat key-value directives from the configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"securityHeaders":{"name":"securityHeaders","type":"\u001a\u0007\u0019\u0007","refs":["\"file\""],"title":"Response headers added via `Header always set NAME VALUE` (header name -\u003e values)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverSignature":{"name":"serverSignature","type":"\u0007","refs":["\"params\""],"title":"ServerSignature footer mode (On, Off, EMail)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverTokens":{"name":"serverTokens","type":"\u0007","refs":["\"params\""],"title":"ServerTokens disclosure level (Full, OS, Minimal, Minor, Major, Prod)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"traceEnable":{"name":"traceEnable","type":"\u0007","refs":["\"params\""],"title":"TraceEnable directive value (on, off, extended)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"virtualHost":{"name":"virtualHost","type":"\u001bapache2.conf.virtualHost","title":"Apache2 VirtualHost block","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"virtualHosts":{"name":"virtualHosts","type":"\u0019\u001bapache2.conf.virtualHost","refs":["\"file\""],"title":"VirtualHost blocks","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"Apache2 HTTP Server configuration","desc":"Parsed Apache configuration covering flat directives, loaded modules, virtual hosts, and Directory / Location access-control blocks, merged across the main config and every Include fragment. Also surfaces hardening-relevant settings such as ServerTokens, ServerSignature, TraceEnable, and response security headers. Pass `init(path: \"...\")` to point at a non-default config file.","min_provider_version":"11.8.14","provider":"go.mondoo.com/cnquery/v9/providers/os"},"apache2.conf.directory":{"id":"apache2.conf.directory","name":"apache2.conf.directory","fields":{"allowOverride":{"name":"allowOverride","type":"\u0007","is_mandatory":true,"title":"AllowOverride directive value (which .htaccess directives are honored, e.g. \"None\", \"All\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0007","is_mandatory":true,"title":"Options directive value (e.g., \"Indexes FollowSymLinks\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this Directory block","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Directory path the \u003cDirectory\u003e block applies to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"require":{"name":"require","type":"\u0019\u0007","is_mandatory":true,"title":"Require directive values (one entry per Require line), the access-control grants for the block","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Apache2 Directory block","private":true,"min_provider_version":"11.8.14","defaults":"path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"apache2.conf.envvars":{"id":"apache2.conf.envvars","name":"apache2.conf.envvars","fields":{"file":{"name":"file","type":"\u001bfile","title":"File defining the environment variables","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"file\""],"title":"Parsed variable assignments (after shell expansion)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"Apache2 environment variables (e.g. Debian's /etc/apache2/envvars)","private":true,"min_provider_version":"13.12.1","defaults":"file.path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"apache2.conf.location":{"id":"apache2.conf.location","name":"apache2.conf.location","fields":{"authName":{"name":"authName","type":"\u0007","is_mandatory":true,"title":"AuthName directive value (realm)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"authType":{"name":"authType","type":"\u0007","is_mandatory":true,"title":"AuthType directive value (None, Basic, Digest, ...)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isMatch":{"name":"isMatch","type":"\u0004","is_mandatory":true,"title":"Whether this block was defined with \u003cLocationMatch\u003e (regex form) instead of \u003cLocation\u003e","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this Location block","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Location path or regex the block matches","provider":"go.mondoo.com/cnquery/v9/providers/os"},"proxyPass":{"name":"proxyPass","type":"\u0007","is_mandatory":true,"title":"ProxyPass target, if set","provider":"go.mondoo.com/cnquery/v9/providers/os"},"require":{"name":"require","type":"\u0019\u0007","is_mandatory":true,"title":"Require directive values (one entry per Require line), the access-control grants for the block","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Apache2 \u003cLocation\u003e block: URL-space access rules","private":true,"min_provider_version":"13.16.10","defaults":"path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"apache2.conf.module":{"id":"apache2.conf.module","name":"apache2.conf.module","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Module name (e.g., \"ssl_module\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Shared object path (e.g., \"modules/mod_ssl.so\")","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Apache2 loaded module","private":true,"min_provider_version":"11.8.14","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"apache2.conf.virtualHost":{"id":"apache2.conf.virtualHost","name":"apache2.conf.virtualHost","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"VirtualHost address (e.g., \"*:443\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"certificate":{"name":"certificate","type":"\u0019\u001bcertificate","title":"X.509 certificates parsed from sslCertificateFile (empty if the file is unreadable)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"documentRoot":{"name":"documentRoot","type":"\u0007","is_mandatory":true,"title":"DocumentRoot directive","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this VirtualHost","provider":"go.mondoo.com/cnquery/v9/providers/os"},"redirects":{"name":"redirects","type":"\u0019\n","is_mandatory":true,"title":"Redirect / RedirectMatch directives within this VirtualHost (target, status, match)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverAliases":{"name":"serverAliases","type":"\u0019\u0007","is_mandatory":true,"title":"ServerAlias names (one entry per name across one or more ServerAlias lines)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverName":{"name":"serverName","type":"\u0007","is_mandatory":true,"title":"ServerName directive","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ssl":{"name":"ssl","type":"\u0004","is_mandatory":true,"title":"Whether SSL is enabled (SSLEngine on)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslCertificateChainFile":{"name":"sslCertificateChainFile","type":"\u0007","is_mandatory":true,"title":"Path to the certificate chain (SSLCertificateChainFile, deprecated in favor of full chain in SSLCertificateFile)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslCertificateFile":{"name":"sslCertificateFile","type":"\u0007","is_mandatory":true,"title":"Path to the server certificate (SSLCertificateFile)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslCertificateKeyFile":{"name":"sslCertificateKeyFile","type":"\u0007","is_mandatory":true,"title":"Path to the server private key (SSLCertificateKeyFile)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslCipherSuite":{"name":"sslCipherSuite","type":"\u0007","is_mandatory":true,"title":"SSLCipherSuite directive value","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslHonorCipherOrder":{"name":"sslHonorCipherOrder","type":"\u0004","is_mandatory":true,"title":"SSLHonorCipherOrder directive value (true when \"on\")","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslProtocol":{"name":"sslProtocol","type":"\u0007","is_mandatory":true,"title":"SSLProtocol directive value (e.g., \"all -SSLv3 -TLSv1 -TLSv1.1\")","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Apache2 VirtualHost block","private":true,"min_provider_version":"11.8.14","defaults":"address serverName ssl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"apparmor":{"id":"apparmor","name":"apparmor","fields":{"process":{"name":"process","type":"\u001bapparmor.process","title":"AppArmor confined process","desc":"Running process attached to an AppArmor profile, giving its executable path, PID, the applied profile, and the confinement status.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"processes":{"name":"processes","type":"\u0019\u001bapparmor.process","title":"Processes with AppArmor confinement","provider":"go.mondoo.com/cnquery/v9/providers/os"},"profile":{"name":"profile","type":"\u001bapparmor.profile","title":"AppArmor profile","desc":"Loaded AppArmor profile and the mode it is running in: enforce (violations blocked), complain (violations logged only), or unconfined.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"profiles":{"name":"profiles","type":"\u0019\u001bapparmor.profile","title":"Loaded AppArmor profiles","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"AppArmor status output version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"AppArmor mandatory access control","desc":"AppArmor status, the loaded profiles and their enforcement modes, and the processes currently under confinement. Use it to confirm AppArmor is active and that security-relevant profiles are in enforce rather than complain or unconfined mode.","min_provider_version":"13.2.4","defaults":"profiles","provider":"go.mondoo.com/cnquery/v9/providers/os"},"apparmor.process":{"id":"apparmor.process","name":"apparmor.process","fields":{"executable":{"name":"executable","type":"\u0007","is_mandatory":true,"title":"Process executable path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pid":{"name":"pid","type":"\u0005","is_mandatory":true,"title":"Process ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"profile":{"name":"profile","type":"\u0007","is_mandatory":true,"title":"Profile applied to this process","provider":"go.mondoo.com/cnquery/v9/providers/os"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Confinement status (e.g., enforce)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"AppArmor confined process","desc":"Running process attached to an AppArmor profile, giving its executable path, PID, the applied profile, and the confinement status.","private":true,"min_provider_version":"13.2.4","defaults":"pid profile status","provider":"go.mondoo.com/cnquery/v9/providers/os"},"apparmor.profile":{"id":"apparmor.profile","name":"apparmor.profile","fields":{"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Profile mode: enforce, complain, or unconfined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Profile name","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"AppArmor profile","desc":"Loaded AppArmor profile and the mode it is running in: enforce (violations blocked), complain (violations logged only), or unconfined.","private":true,"min_provider_version":"13.2.4","defaults":"name mode","provider":"go.mondoo.com/cnquery/v9/providers/os"},"apt":{"id":"apt","name":"apt","fields":{"repo":{"name":"repo","type":"\u001bapt.repo","title":"APT software repository","desc":"A single configured APT repository parsed from a sources list: its package `type` (`deb` for binary or `deb-src` for source), the `url` it fetches from, the `distribution` (suite) and `components` it pulls, and the `file` that declares it. The security-relevant fields are `trusted`, true when the entry carries `[trusted=yes]`, which disables signature verification, and `signedBy`, the keyring path pinning which key may sign the repository. `enabled` is false for entries commented out in a one-line sources file or marked `Enabled: no` in a deb822 file.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"repos":{"name":"repos","type":"\u0019\u001bapt.repo","title":"All configured APT repositories","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Advanced Package Tool (APT) configuration","desc":"Debian/Ubuntu package management configuration. `repos` enumerates every configured APT repository across `/etc/apt/sources.list` and the `/etc/apt/sources.list.d/` directory, parsing both the classic one-line format and the deb822 `.sources` format. Audit repository trust from there: each `apt.repo` reports whether it is marked `trusted` (signature checks bypassed) and the `signedBy` keyring that pins which key may sign it.","min_provider_version":"13.22.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"apt.repo":{"id":"apt.repo","name":"apt.repo","fields":{"components":{"name":"components","type":"\u0019\u0007","is_mandatory":true,"title":"Components enabled for this repository (e.g., `main`, `contrib`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"distribution":{"name":"distribution","type":"\u0007","is_mandatory":true,"title":"Distribution / suite (e.g., `bookworm`, `noble-security`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the repository entry is active","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"Source list file that declares this repository","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signedBy":{"name":"signedBy","type":"\u0007","is_mandatory":true,"title":"Keyring path pinning the signing key (`signed-by`), empty when unset","provider":"go.mondoo.com/cnquery/v9/providers/os"},"trusted":{"name":"trusted","type":"\u0004","is_mandatory":true,"title":"Whether signature verification is bypassed (`[trusted=yes]`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Package type: `deb` (binary) or `deb-src` (source)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Repository URI packages are fetched from","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"APT software repository","desc":"A single configured APT repository parsed from a sources list: its package `type` (`deb` for binary or `deb-src` for source), the `url` it fetches from, the `distribution` (suite) and `components` it pulls, and the `file` that declares it. The security-relevant fields are `trusted`, true when the entry carries `[trusted=yes]`, which disables signature verification, and `signedBy`, the keyring path pinning which key may sign the repository. `enabled` is false for entries commented out in a one-line sources file or marked `Enabled: no` in a deb822 file.","private":true,"min_provider_version":"13.22.2","defaults":"type url distribution","provider":"go.mondoo.com/cnquery/v9/providers/os"},"asset":{"id":"asset","name":"asset","fields":{"cpes":{"name":"cpes","type":"\u0019\u001bcpe","title":"Common Platform Enumeration (CPE) identifiers for the asset","desc":"The list of CPE strings that describe the asset's platform and software, used to correlate the asset against CPE-indexed vulnerability data.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"eol":{"name":"eol","type":"\u001basset.eol","title":"Operating system end-of-life status","desc":"End-of-Life metadata Mondoo publishes for the asset's detected operating system or platform: the EoL date itself, a product-page URL, and a documentation URL. Used by audits to flag hosts whose vendor has stopped issuing security patches and to plan migrations before unsupported software accumulates risk.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"purl":{"name":"purl","type":"\u0007","title":"Platform identity in package URL (purl) format","desc":"The asset's platform expressed as a package URL rather than a CPE string, for matching against purl-indexed vulnerability and software-inventory data.","min_provider_version":"11.3.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vulnerabilityReport":{"name":"vulnerabilityReport","type":"\n","title":"Advisory and vulnerability report","desc":"Deprecated in favor of the `vulnmgmt` resource. Will be removed in version 13.0.","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"deprecated"}},"is_extension":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"asset.eol":{"id":"asset.eol","name":"asset.eol","fields":{"date":{"name":"date","type":"\t","is_mandatory":true,"title":"Date after which the vendor no longer provides support or patches","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docsUrl":{"name":"docsUrl","type":"\u0007","is_mandatory":true,"title":"Documentation URL for the platform's end-of-life policy","provider":"go.mondoo.com/cnquery/v9/providers/os"},"productUrl":{"name":"productUrl","type":"\u0007","is_mandatory":true,"title":"Product page URL for the detected platform","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Operating system end-of-life status","desc":"End-of-Life metadata Mondoo publishes for the asset's detected operating system or platform: the EoL date itself, a product-page URL, and a documentation URL. Used by audits to flag hosts whose vendor has stopped issuing security patches and to plan migrations before unsupported software accumulates risk.","min_provider_version":"9.0.1","defaults":"date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"audit":{"id":"audit","fields":{"advisory":{"name":"advisory","type":"\u001baudit.advisory","title":"Platform/package advisory","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"cve":{"name":"cve","type":"\u001baudit.cve","title":"Common Vulnerabilities and Exposures (CVEs)","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"cvss":{"name":"cvss","type":"\u001baudit.cvss","title":"Common Vulnerability Scoring System (CVSS) score","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"audit.advisory":{"id":"audit.advisory","name":"audit.advisory","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Advisory description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Advisory ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modified":{"name":"modified","type":"\t","is_mandatory":true,"title":"Last modification date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mrn":{"name":"mrn","type":"\u0007","is_mandatory":true,"title":"Mondoo advisory identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"published":{"name":"published","type":"\t","is_mandatory":true,"title":"Advisory publication date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Advisory title","provider":"go.mondoo.com/cnquery/v9/providers/os"},"worstScore":{"name":"worstScore","type":"\u001baudit.cvss","is_mandatory":true,"title":"Worst CVSS score of all assigned CVEs","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Platform/package advisory","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"audit.cve":{"id":"audit.cve","name":"audit.cve","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"CVE ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modified":{"name":"modified","type":"\t","is_mandatory":true,"title":"Last modification date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mrn":{"name":"mrn","type":"\u0007","is_mandatory":true,"title":"Mondoo CVE identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"published":{"name":"published","type":"\t","is_mandatory":true,"title":"Publication date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"CVE state","provider":"go.mondoo.com/cnquery/v9/providers/os"},"summary":{"name":"summary","type":"\u0007","is_mandatory":true,"title":"Summary description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"unscored":{"name":"unscored","type":"\u0004","is_mandatory":true,"title":"Whether the CVE has no assigned CVSS score","provider":"go.mondoo.com/cnquery/v9/providers/os"},"worstScore":{"name":"worstScore","type":"\u001baudit.cvss","is_mandatory":true,"title":"Worst CVSS score of all assigned CVEs","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Common Vulnerabilities and Exposures (CVEs)","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"audit.cvss":{"id":"audit.cvss","name":"audit.cvss","fields":{"score":{"name":"score","type":"\u0006","is_mandatory":true,"title":"CVSS score ranging from 0.0 to 10.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vector":{"name":"vector","type":"\u0007","is_mandatory":true,"title":"CVSS score represented as a vector string","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Common Vulnerability Scoring System (CVSS) score","private":true,"min_provider_version":"9.0.1","defaults":"score","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditd":{"id":"auditd","fields":{"config":{"name":"config","type":"\u001bauditd.config","title":"auditd (Linux Audit Daemon) global configuration","desc":"/etc/audit/auditd.conf parameters as a key-value map, covering log rotation, disk-space thresholds, and failure actions. `params` keys such as max_log_file, space_left_action, and disk_full_action drive audit-logging hardening checks.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"rule":{"name":"rule","type":"\u001bauditd.rule","title":"auditd (Linux Audit Daemon) rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"rules":{"name":"rules","type":"\u001bauditd.rules","title":"auditd (Linux Audit Daemon) ruleset on disk","desc":"Kernel audit ruleset as loaded from the on-disk rule files, broken out into three families: controls (daemon and buffer settings), file watches, and syscall rules. By default the rule files under /etc/audit/rules.d are read and merged in filename order; pass a path to point at a different file or directory. Use this to confirm that required watches (for example on /etc/shadow or /etc/sudoers) and syscall audits mandated by a hardening baseline are present.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"auditd.config":{"id":"auditd.config","name":"auditd.config","fields":{"file":{"name":"file","type":"\u001bfile","title":"File of this auditd configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"file\""],"title":"Configuration values of this config","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"auditd (Linux Audit Daemon) global configuration","desc":"/etc/audit/auditd.conf parameters as a key-value map, covering log rotation, disk-space thresholds, and failure actions. `params` keys such as max_log_file, space_left_action, and disk_full_action drive audit-logging hardening checks.","min_provider_version":"11.4.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditd.rule":{"id":"auditd.rule","name":"auditd.rule","fields":{"control":{"name":"control","type":"\u001bauditd.rule.control","title":"auditd (Linux Audit Daemon) rule for a control","desc":"Control setting from the ruleset, split into a flag and an optional value. For example `--backlog_wait_time 60000` becomes {flag: \"--backlog_wait_time\", value: \"60000\"}, `-b 8192` becomes {flag: \"-b\", value: \"8192\"}, and a valueless `-D` (delete all rules) becomes {flag: \"-D\", value: nil}.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"file":{"name":"file","type":"\u001bauditd.rule.file","title":"auditd (Linux Audit Daemon) rule for a file","desc":"File watch rule (-w) describing a path auditd monitors, the access types that trigger an event, and the key that tags matching records. For example `-w /etc/shadow -p rw -k shadow_access` becomes {path: \"/etc/shadow\", permissions: \"rw\", keyname: \"shadow_access\"}.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"syscall":{"name":"syscall","type":"\u001bauditd.rule.syscall","title":"auditd (Linux Audit Daemon) rule for a syscall","desc":"Syscall audit rule (-a) that fires on the listed system calls when the field filters match. For example `-a always,exit -F arch=b32 -F auid\u003e=1000 -F auid!=unset` becomes =\u003e { action: \"always\", list: \"exit\", syscalls: [], field_entries: [ key=\"arch\" op=\"=\" value=\"b32\" key=\"auid\" op=\"\u003e=\" value=\"1000\" key=\"auid\" op=\"!=\" value=\"unset\" ], keyname: nil, }","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"title":"auditd (Linux Audit Daemon) rule","private":true,"min_provider_version":"11.4.21","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditd.rule.control":{"id":"auditd.rule.control","name":"auditd.rule.control","fields":{"flag":{"name":"flag","type":"\u0007","is_mandatory":true,"title":"Control flag, the first token including any leading `-` (e.g. \"-b\", \"--backlog_wait_time\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Value following the flag, or null for valueless controls like -D","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"auditd (Linux Audit Daemon) rule for a control","desc":"Control setting from the ruleset, split into a flag and an optional value. For example `--backlog_wait_time 60000` becomes {flag: \"--backlog_wait_time\", value: \"60000\"}, `-b 8192` becomes {flag: \"-b\", value: \"8192\"}, and a valueless `-D` (delete all rules) becomes {flag: \"-D\", value: nil}.","private":true,"min_provider_version":"11.4.21","defaults":"flag value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditd.rule.file":{"id":"auditd.rule.file","name":"auditd.rule.file","fields":{"keyname":{"name":"keyname","type":"\u0007","is_mandatory":true,"title":"Key tagging records this rule produces (from -k), for filtering audit logs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Watched path (the argument to -w)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"permissions":{"name":"permissions","type":"\u0007","is_mandatory":true,"title":"Access types that trigger the watch (from -p): any of r, w, x, a","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"auditd (Linux Audit Daemon) rule for a file","desc":"File watch rule (-w) describing a path auditd monitors, the access types that trigger an event, and the key that tags matching records. For example `-w /etc/shadow -p rw -k shadow_access` becomes {path: \"/etc/shadow\", permissions: \"rw\", keyname: \"shadow_access\"}.","private":true,"min_provider_version":"11.4.21","defaults":"path permissions","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditd.rule.syscall":{"id":"auditd.rule.syscall","name":"auditd.rule.syscall","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action taken when the rule matches (from -a): \"always\" or \"never\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"arch":{"name":"arch","type":"\u0007","is_mandatory":true,"title":"CPU architecture this rule is restricted to","desc":"The value of the `-F arch=` filter, normally `b64` or `b32`. Empty when the rule has no architecture filter and therefore applies to all architectures.","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auidMin":{"name":"auidMin","type":"\u0005","is_mandatory":true,"title":"Minimum audit UID this rule is restricted to","desc":"The threshold N from a `-F auid\u003e=N` filter, commonly `1000` to target interactive users above the system UID range. Null when the rule has no `auid\u003e=` filter.","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"comparisons":{"name":"comparisons","type":"\u0019\n","is_mandatory":true,"title":"Inter-field comparisons (from -C), each entry a {key, op, value} dict","provider":"go.mondoo.com/cnquery/v9/providers/os"},"excludesUnsetAuid":{"name":"excludesUnsetAuid","type":"\u0004","is_mandatory":true,"title":"Whether the rule excludes events with an unset audit UID","desc":"True when the rule carries a `-F auid!=unset` filter (also matching the raw sentinels `4294967295` and `-1`), which drops events from daemons and other processes that never had a login UID assigned.","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fields":{"name":"fields","type":"\u0019\n","is_mandatory":true,"title":"Raw field filters (from -F), each entry a {key, op, value} dict","provider":"go.mondoo.com/cnquery/v9/providers/os"},"keyname":{"name":"keyname","type":"\u0007","is_mandatory":true,"title":"Key tagging records this rule produces (from -k), for filtering audit logs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0007","is_mandatory":true,"title":"Rule list the action applies to (second value of -a): exit, task, user, exclude, or filesystem","provider":"go.mondoo.com/cnquery/v9/providers/os"},"syscalls":{"name":"syscalls","type":"\u0019\u0007","is_mandatory":true,"title":"System calls this rule matches (from -S); empty when the rule matches all syscalls","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"auditd (Linux Audit Daemon) rule for a syscall","desc":"Syscall audit rule (-a) that fires on the listed system calls when the field filters match. For example `-a always,exit -F arch=b32 -F auid\u003e=1000 -F auid!=unset` becomes =\u003e { action: \"always\", list: \"exit\", syscalls: [], field_entries: [ key=\"arch\" op=\"=\" value=\"b32\" key=\"auid\" op=\"\u003e=\" value=\"1000\" key=\"auid\" op=\"!=\" value=\"unset\" ], keyname: nil, }","private":true,"min_provider_version":"11.4.21","defaults":"action list","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditd.rules":{"id":"auditd.rules","name":"auditd.rules","fields":{"controls":{"name":"controls","type":"\u0019\u001bauditd.rule.control","refs":["\"path\""],"title":"Control rules (buffer size, failure mode, and other daemon settings)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bauditd.rule.file","refs":["\"path\""],"title":"File watch rules (-w entries)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","title":"Directory or file the rules are read from (defaults to /etc/audit/rules.d)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"syscalls":{"name":"syscalls","type":"\u0019\u001bauditd.rule.syscall","refs":["\"path\""],"title":"Syscall audit rules (-a entries)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"auditd (Linux Audit Daemon) ruleset on disk","desc":"Kernel audit ruleset as loaded from the on-disk rule files, broken out into three families: controls (daemon and buffer settings), file watches, and syscall rules. By default the rule files under /etc/audit/rules.d are read and merged in filename order; pass a path to point at a different file or directory. Use this to confirm that required watches (for example on /etc/shadow or /etc/sudoers) and syscall audits mandated by a hardening baseline are present.","min_provider_version":"11.4.21","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditpol":{"id":"auditpol","name":"auditpol","fields":{"entry":{"name":"entry","type":"\u001bauditpol.entry","title":"Windows audit policy entry","desc":"Deprecated in favor of windows.auditPolicy.subcategory, which reports subcategory names and categories in English regardless of the OS display language. This entry carries the subcategory name, GUID, inclusion setting, and exclusion setting as reported by the system, plus the `success` and `failure` booleans derived from the inclusion setting.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"deprecated"},"list":{"name":"list","type":"\u0019\u001bauditpol.entry","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bauditpol.entry","title":"Windows audit policies","desc":"Deprecated in favor of windows.auditPolicy, which reports subcategory names and categories in English regardless of the OS display language and supports looking up a single subcategory by name or GUID.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"deprecated"},"auditpol.entry":{"id":"auditpol.entry","name":"auditpol.entry","fields":{"exclusionsetting":{"name":"exclusionsetting","type":"\u0007","is_mandatory":true,"title":"Exclusive settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"failure":{"name":"failure","type":"\u0004","title":"Whether the inclusion setting audits failure events","desc":"True for \"Failure\" and \"Success and Failure\".","min_provider_version":"13.22.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inclusionsetting":{"name":"inclusionsetting","type":"\u0007","is_mandatory":true,"title":"Inclusive setting","provider":"go.mondoo.com/cnquery/v9/providers/os"},"machinename":{"name":"machinename","type":"\u0007","is_mandatory":true,"title":"Machine name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"policytarget":{"name":"policytarget","type":"\u0007","is_mandatory":true,"title":"Policy target","provider":"go.mondoo.com/cnquery/v9/providers/os"},"subcategory":{"name":"subcategory","type":"\u0007","is_mandatory":true,"title":"Subcategory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"subcategoryguid":{"name":"subcategoryguid","type":"\u0007","is_mandatory":true,"title":"Subcategory GUID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"success":{"name":"success","type":"\u0004","title":"Whether the inclusion setting audits success events","desc":"True for \"Success\" and \"Success and Failure\".","min_provider_version":"13.22.2","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows audit policy entry","desc":"Deprecated in favor of windows.auditPolicy.subcategory, which reports subcategory names and categories in English regardless of the OS display language. This entry carries the subcategory name, GUID, inclusion setting, and exclusion setting as reported by the system, plus the `success` and `failure` booleans derived from the inclusion setting.","min_provider_version":"9.0.1","defaults":"subcategory inclusionsetting exclusionsetting","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"deprecated"},"augment":{"id":"augment","name":"augment","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Augment configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001baugment.skill","title":"Augment skill","desc":"A single SKILL.md definition discovered for the Augment agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001baugment.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Augment Code instance","desc":"Augment Code, an AI coding assistant, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .augment in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://www.augmentcode.com/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"augment.skill":{"id":"augment.skill","name":"augment.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Augment skill","desc":"A single SKILL.md definition discovered for the Augment agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"authorizedkeys":{"id":"authorizedkeys","name":"authorizedkeys","fields":{"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"Key file content","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entry":{"name":"entry","type":"\u001bauthorizedkeys.entry","title":"SSH authorized key","desc":"Single entry from an `authorized_keys` file: the source line number, key type, key material, label, and any SSH options such as `command=`, `from=`, or `no-port-forwarding`. Used to audit which keys grant SSH access to a user and to flag entries that lack source or command restrictions.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"Key file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bauthorizedkeys.entry","refs":["\"file\"","\"content\""],"provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the key file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"list_type":"\u001bauthorizedkeys.entry","title":"SSH authorized_keys file","desc":"Single `authorized_keys` file: its path, the `file` reference, the raw `content` string, and the parsed `entry` list where each entry surfaces the line number, key type, key material, label, and any `command=` / `from=` / `no-port-forwarding` SSH options. Select the file by absolute path, for example `authorizedkeys(path: \"/root/.ssh/authorized_keys\")`, or reach it per account through the `user` resource, whose `authorizedkeys` field resolves each user's `~/.ssh/authorized_keys` automatically (for example `users.where(name == \"root\") { authorizedkeys { list { key } } }`). Used to audit which keys actually grant SSH access to a given user and to detect entries with no source or command restrictions.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"authorizedkeys.entry":{"id":"authorizedkeys.entry","name":"authorizedkeys.entry","fields":{"bits":{"name":"bits","type":"\u0005","is_mandatory":true,"title":"Key size in bits (e.g., 2048, 256, 384, 521)","min_provider_version":"13.34.4","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"Key file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Base64-encoded public key material","provider":"go.mondoo.com/cnquery/v9/providers/os"},"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"Key label or comment (typically user@host)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"line":{"name":"line","type":"\u0005","is_mandatory":true,"title":"Line number of the entry in the key file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"SSH key options (e.g., command restrictions, source IP limits)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Key type (e.g., ssh-rsa, ssh-ed25519, ecdsa-sha2-nistp256)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"SSH authorized key","desc":"Single entry from an `authorized_keys` file: the source line number, key type, key material, label, and any SSH options such as `command=`, `from=`, or `no-port-forwarding`. Used to audit which keys grant SSH access to a user and to flag entries that lack source or command restrictions.","min_provider_version":"9.0.0","defaults":"key","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cgroup":{"id":"cgroup","name":"cgroup","fields":{"children":{"name":"children","type":"\u0019\u001bcgroup","title":"Child cgroups directly under this one","provider":"go.mondoo.com/cnquery/v9/providers/os"},"controllers":{"name":"controllers","type":"\u0019\u0007","is_mandatory":true,"title":"Controllers enabled on this cgroup (from cgroup.controllers)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cpuMaxPeriodUSec":{"name":"cpuMaxPeriodUSec","type":"\u0005","is_mandatory":true,"title":"CPU accounting period in microseconds","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cpuMaxQuotaUSec":{"name":"cpuMaxQuotaUSec","type":"\u0005","is_mandatory":true,"title":"CPU quota in microseconds per period; `-1` means unlimited","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cpuWeight":{"name":"cpuWeight","type":"\u0005","is_mandatory":true,"title":"Relative CPU weight (1-10000, default 100)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"memoryCurrent":{"name":"memoryCurrent","type":"\u0005","is_mandatory":true,"title":"Current memory usage in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"memoryHigh":{"name":"memoryHigh","type":"\u0005","is_mandatory":true,"title":"Memory soft limit / throttling watermark in bytes; `-1` means unlimited","provider":"go.mondoo.com/cnquery/v9/providers/os"},"memoryMax":{"name":"memoryMax","type":"\u0005","is_mandatory":true,"title":"Memory hard limit in bytes; `-1` means unlimited","provider":"go.mondoo.com/cnquery/v9/providers/os"},"memorySwapMax":{"name":"memorySwapMax","type":"\u0005","is_mandatory":true,"title":"Swap hard limit in bytes; `-1` means unlimited","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path relative to the cgroup root (e.g., /system.slice/docker-\u003cid\u003e.scope)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pids":{"name":"pids","type":"\u0019\u0005","is_mandatory":true,"title":"Process IDs assigned to this cgroup","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pidsCurrent":{"name":"pidsCurrent","type":"\u0005","is_mandatory":true,"title":"Current number of processes in this cgroup","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pidsMax":{"name":"pidsMax","type":"\u0005","is_mandatory":true,"title":"PID hard limit; `-1` means unlimited","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Kernel cgroup type from `cgroup.type`","desc":"One of `domain`, `domain_threaded`, `domain_invalid`, or `threaded`. Empty when the file is unreadable (typically the root cgroup, where `cgroup.type` does not exist).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"unitType":{"name":"unitType","type":"\u0007","is_mandatory":true,"title":"systemd unit kind inferred from the leaf name","desc":"One of `slice`, `scope`, `service`, `root`, or `other`.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Linux control group","desc":"Single cgroup v2 entry: its `path` relative to the cgroup root, the kernel `type` (domain, threaded, etc.), the systemd-inferred `unitType` (slice, scope, service, or other), the controllers enabled on it, memory/CPU/PIDs limits and current usage, and the process IDs assigned to the cgroup. Iterated from `cgroups.list` or traversed via `children`. Limit fields use `-1` to mean unlimited (the kernel's `max` literal).","private":true,"min_provider_version":"13.16.10","defaults":"path unitType memoryMax","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cgroups":{"id":"cgroups","name":"cgroups","fields":{"controllers":{"name":"controllers","type":"\u0019\u0007","title":"Controllers available on the host (e.g., memory, cpu, io, pids)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bcgroup","title":"Flat list of every cgroup on the host","provider":"go.mondoo.com/cnquery/v9/providers/os"},"root":{"name":"root","type":"\u001bcgroup","title":"The root cgroup","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0005","title":"cgroup version in use: 2 (unified), 1 (legacy v1 only), or 0 if cgroups are not available","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Linux control groups (cgroup v2)","desc":"cgroup hierarchy, available controllers, and the version of cgroups in use. Modern Linux uses cgroup v2 (a single unified hierarchy at /sys/fs/cgroup); v1 hosts and hybrid setups are detected and reported via `version`, but per-controller hierarchies are not modeled. Iterate `list` to query every cgroup on the host, or walk down from `root` to traverse the hierarchy.","min_provider_version":"13.16.10","defaults":"version controllers","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chocolatey":{"id":"chocolatey","fields":{"package":{"name":"package","type":"\u001bchocolatey.package","title":"Chocolatey package","desc":"Single installed Chocolatey package, exposing its version, license and license URL, project and package URLs, declared dependencies, tags, and whether it is pinned against automatic upgrades.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bchocolatey.packages","title":"Chocolatey package inventory (Windows)","desc":"Chocolatey packages installed on a Windows host, each with version, license, dependencies, and pin state. Filter with `chocolatey.packages.where(pinned == true)` to find packages held back from upgrades.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"chocolatey.package":{"id":"chocolatey.package","name":"chocolatey.package","fields":{"author":{"name":"author","type":"\u0007","is_mandatory":true,"title":"Package author(s)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dependencies":{"name":"dependencies","type":"\u0019\u0007","is_mandatory":true,"title":"Package dependencies","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Full description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"license":{"name":"license","type":"\u0007","is_mandatory":true,"title":"License name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"licenseUrl":{"name":"licenseUrl","type":"\u0007","is_mandatory":true,"title":"License URL","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Package name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Package install path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pinned":{"name":"pinned","type":"\u0004","is_mandatory":true,"title":"Whether the package is pinned (won't auto-upgrade)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"projectUrl":{"name":"projectUrl","type":"\u0007","is_mandatory":true,"title":"Upstream project URL","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","is_mandatory":true,"title":"Package URL (purl), a standardized identifier for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"summary":{"name":"summary","type":"\u0007","is_mandatory":true,"title":"Short description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Package tags","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Chocolatey package","desc":"Single installed Chocolatey package, exposing its version, license and license URL, project and package URLs, declared dependencies, tags, and whether it is pinned against automatic upgrades.","private":true,"min_provider_version":"13.11.1","defaults":"name version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chocolatey.packages":{"id":"chocolatey.packages","name":"chocolatey.packages","fields":{"list":{"name":"list","type":"\u0019\u001bchocolatey.package","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bchocolatey.package","title":"Chocolatey package inventory (Windows)","desc":"Chocolatey packages installed on a Windows host, each with version, license, dependencies, and pin state. Filter with `chocolatey.packages.where(pinned == true)` to find packages held back from upgrades.","min_provider_version":"13.11.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chrome":{"id":"chrome","name":"chrome","fields":{"extension":{"name":"extension","type":"\u001bchrome.extension","title":"Chrome browser extension","desc":"Single installed Chromium-family browser extension and its manifest metadata: the `identifier`, `name`, `version`, requested `permissions` and `optionalPermissions`, on-disk `path`, owning `profile` and `browser`, whether it came from the Web Store, whether it is `enabled`, and the declared content scripts. Audits use the permissions and `fromWebstore` fields to flag over-privileged or unvetted extensions.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"extensionContentScript":{"name":"extensionContentScript","type":"\u001bchrome.extensionContentScript","title":"Chrome extension content script","desc":"Content script declared by a Chrome-family extension: a JavaScript file the extension injects into pages whose URLs match a pattern. Each record ties the injected `script` to the `match` pattern that triggers it and to the owning extension (`identifier`, `version`) and user (`uid`), so you can audit which extensions run code against which sites and flag broad patterns such as `\u003call_urls\u003e`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"extensionContentScripts":{"name":"extensionContentScripts","type":"\u0019\u001bchrome.extensionContentScript","title":"All content scripts from all Chrome extensions across all profiles and users","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"extensions":{"name":"extensions","type":"\u0019\u001bchrome.extension","title":"All installed Chrome extensions across all profiles and users","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Chromium-family browsers (Chrome, Brave, Edge variants)","desc":"Installed browser extensions across all users and profiles for Chromium-based browsers. The `extensions` field lists every extension with its manifest metadata and permissions, and `extensionContentScripts` lists the content scripts those extensions inject into web pages. Useful for auditing risky permissions and unexpected or side-loaded extensions.","min_provider_version":"11.4.84","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chrome.extension":{"id":"chrome.extension","name":"chrome.extension","fields":{"author":{"name":"author","type":"\u0007","is_mandatory":true,"title":"Extension author from manifest","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"browser":{"name":"browser","type":"\u0007","is_mandatory":true,"title":"Browser name (e.g., \"Google Chrome\", \"Chromium\", \"Google Chrome Beta\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"contentScripts":{"name":"contentScripts","type":"\u0019\u001bchrome.extensionContentScript","is_mandatory":true,"title":"Content scripts declared by this extension","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"defaultLocale":{"name":"defaultLocale","type":"\u0007","is_mandatory":true,"title":"Default locale for internationalization","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Extension description from manifest","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the extension is currently enabled","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fromWebstore":{"name":"fromWebstore","type":"\u0004","is_mandatory":true,"title":"Whether the extension was installed from the Chrome Web Store","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"Unique extension identifier (32-character string)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installTime":{"name":"installTime","type":"\t","is_mandatory":true,"title":"Extension install time","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"manifestHash":{"name":"manifestHash","type":"\u0007","is_mandatory":true,"title":"SHA-256 hash of the on-disk manifest.json file","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"manifestVersion":{"name":"manifestVersion","type":"\u0005","is_mandatory":true,"title":"Chrome extension manifest version (2 or 3)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Extension name from manifest","provider":"go.mondoo.com/cnquery/v9/providers/os"},"optionalPermissions":{"name":"optionalPermissions","type":"\u0019\u0007","is_mandatory":true,"title":"Optional permissions that may be granted at runtime","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the extension directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"permissions":{"name":"permissions","type":"\u0019\u0007","is_mandatory":true,"title":"Permissions requested by the extension (includes host_permissions for Manifest V3)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"persistent":{"name":"persistent","type":"\u0004","is_mandatory":true,"title":"Whether the extension runs persistently in the background (Manifest V2 only; V3 is always false)","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"profile":{"name":"profile","type":"\u0007","is_mandatory":true,"title":"Chrome profile name where extension is installed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"profilePath":{"name":"profilePath","type":"\u0007","is_mandatory":true,"title":"Full path to the Chrome profile directory","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"referenced":{"name":"referenced","type":"\u0004","is_mandatory":true,"title":"Whether the extension directory exists on disk (referenced in Preferences)","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Extension state (e.g., \"enabled\", \"disabled\")","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uid":{"name":"uid","type":"\u0005","is_mandatory":true,"title":"UID of the user who owns this extension","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"updateUrl":{"name":"updateUrl","type":"\u0007","is_mandatory":true,"title":"URL used to check for extension updates","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Extension version from manifest","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Chrome browser extension","desc":"Single installed Chromium-family browser extension and its manifest metadata: the `identifier`, `name`, `version`, requested `permissions` and `optionalPermissions`, on-disk `path`, owning `profile` and `browser`, whether it came from the Web Store, whether it is `enabled`, and the declared content scripts. Audits use the permissions and `fromWebstore` fields to flag over-privileged or unvetted extensions.","private":true,"min_provider_version":"11.4.84","defaults":"name version identifier browser","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chrome.extensionContentScript":{"id":"chrome.extensionContentScript","name":"chrome.extensionContentScript","fields":{"browserType":{"name":"browserType","type":"\u0007","is_mandatory":true,"title":"Browser name (e.g., \"Google Chrome\", \"Brave\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"Parent extension identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"match":{"name":"match","type":"\u0007","is_mandatory":true,"title":"URL match pattern where the script executes (e.g., \"https://*/*\", \"\u003call_urls\u003e\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the extension directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"profilePath":{"name":"profilePath","type":"\u0007","is_mandatory":true,"title":"Full path to the Chrome profile directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"script":{"name":"script","type":"\u0007","is_mandatory":true,"title":"JavaScript content script filename","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uid":{"name":"uid","type":"\u0005","is_mandatory":true,"title":"UID of the owning user","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Parent extension version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Chrome extension content script","desc":"Content script declared by a Chrome-family extension: a JavaScript file the extension injects into pages whose URLs match a pattern. Each record ties the injected `script` to the `match` pattern that triggers it and to the owning extension (`identifier`, `version`) and user (`uid`), so you can audit which extensions run code against which sites and flag broad patterns such as `\u003call_urls\u003e`.","private":true,"min_provider_version":"13.9.3","defaults":"script match","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chrony":{"id":"chrony","fields":{"conf":{"name":"conf","type":"\u001bchrony.conf","title":"Chrony NTP daemon configuration","desc":"Configuration of chrony, the default NTP implementation on modern RHEL, Fedora, SUSE, and Debian/Ubuntu systems. The parsed fields expose the configuration in structured form so audits can assert on individual directives without regex over the raw text: `servers`, `pools`, and `peers` enumerate the configured time sources; `allow` and `deny` expose the NTP-server access control lists that decide which clients this host serves time to (an empty `allow` means the daemon does not answer client requests); `bindCmdAddresses` reports where the control socket listens; and `keyFile`, `makeStep`, and `rtcSync` cover the authentication key file, clock-stepping policy, and real-time-clock synchronization. Select an alternate file with `chrony.conf(path: \"...\")`; the default resolves to `/etc/chrony.conf` (RHEL family) or `/etc/chrony/chrony.conf` (Debian family).","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"chrony.conf":{"id":"chrony.conf","name":"chrony.conf","fields":{"allow":{"name":"allow","type":"\u0019\u0007","refs":["\"settings\""],"title":"Hosts permitted to use this system as a time server (`allow` directives)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"bindCmdAddresses":{"name":"bindCmdAddresses","type":"\u0019\u0007","refs":["\"settings\""],"title":"Addresses the command/monitoring socket binds to (`bindcmdaddress`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"Raw contents of the chrony configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"deny":{"name":"deny","type":"\u0019\u0007","refs":["\"settings\""],"title":"Hosts denied use of this system as a time server (`deny` directives)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","title":"File backing the chrony configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"keyFile":{"name":"keyFile","type":"\u0007","refs":["\"settings\""],"title":"Path to the NTP authentication key file (`keyfile`), empty when unset","provider":"go.mondoo.com/cnquery/v9/providers/os"},"makeStep":{"name":"makeStep","type":"\u0007","refs":["\"settings\""],"title":"Clock-stepping policy from the `makestep` directive, empty when unset","provider":"go.mondoo.com/cnquery/v9/providers/os"},"peers":{"name":"peers","type":"\u0019\u0007","refs":["\"settings\""],"title":"Symmetric peers from `peer` directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pools":{"name":"pools","type":"\u0019\u0007","refs":["\"settings\""],"title":"Time-source pools from `pool` directives (host plus any options)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rtcSync":{"name":"rtcSync","type":"\u0004","refs":["\"settings\""],"title":"Whether the real-time clock is kept in sync (`rtcsync` directive present)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"servers":{"name":"servers","type":"\u0019\u0007","refs":["\"settings\""],"title":"Time sources from `server` directives (host plus any options)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"settings":{"name":"settings","type":"\u0019\u0007","refs":["\"content\""],"title":"Effective settings with comments and blank lines removed","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"Chrony NTP daemon configuration","desc":"Configuration of chrony, the default NTP implementation on modern RHEL, Fedora, SUSE, and Debian/Ubuntu systems. The parsed fields expose the configuration in structured form so audits can assert on individual directives without regex over the raw text: `servers`, `pools`, and `peers` enumerate the configured time sources; `allow` and `deny` expose the NTP-server access control lists that decide which clients this host serves time to (an empty `allow` means the daemon does not answer client requests); `bindCmdAddresses` reports where the control socket listens; and `keyFile`, `makeStep`, and `rtcSync` cover the authentication key file, clock-stepping policy, and real-time-clock synchronization. Select an alternate file with `chrony.conf(path: \"...\")`; the default resolves to `/etc/chrony.conf` (RHEL family) or `/etc/chrony/chrony.conf` (Debian family).","min_provider_version":"13.22.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"claude":{"id":"claude","fields":{"code":{"name":"code","type":"\u001bclaude.code","title":"Claude Code (Anthropic CLI agent) instance","desc":"Claude Code installation on the host, exposing the account it is signed into (`email`, `organization`, `role`, `subscription`), the installing `package` and host `runtime`, and the agent's configured surface: `enabledPlugins`, `plugins`, `skills`, `projects`, and `mcpServers`. Audit which plugins, skills, and MCP servers are configured, and which projects the agent can access. The `configPath` selects the configuration directory when it is not the default. URL: https://claude.ai/code","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"}},"is_extension":true},"claude.code":{"id":"claude.code","name":"claude.code","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Claude Code configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"email":{"name":"email","type":"\u0007","title":"Account email","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabledPlugins":{"name":"enabledPlugins","type":"\u0019\u0007","title":"List of enabled plugin names","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mcpServer":{"name":"mcpServer","type":"\u001bclaude.code.mcpServer","title":"Claude Code MCP server","desc":"Single Model Context Protocol server configured for Claude Code. `name` identifies the server, `needsAuth` reports whether it requires authentication, and `lastChecked` is when its auth state was last verified.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"mcpServers":{"name":"mcpServers","type":"\u0019\u001bclaude.code.mcpServer","title":"MCP servers","provider":"go.mondoo.com/cnquery/v9/providers/os"},"organization":{"name":"organization","type":"\u0007","title":"Organization name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"organizationId":{"name":"organizationId","type":"\u0007","title":"Organization ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"plugin":{"name":"plugin","type":"\u001bclaude.code.plugin","title":"Claude Code installed plugin","desc":"Single plugin installed into Claude Code. Records the plugin `name`, `version`, install `scope` (user or project), on-disk `installPath`, install and update timestamps, the pinned `gitCommitSha`, and whether it is currently `enabled`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"plugins":{"name":"plugins","type":"\u0019\u001bclaude.code.plugin","title":"Installed plugins","provider":"go.mondoo.com/cnquery/v9/providers/os"},"project":{"name":"project","type":"\u001bclaude.code.project","title":"Claude Code project","desc":"Single project directory Claude Code is configured to work in. `path` is the filesystem location and `hasMemory` reports whether persistent memory is configured for it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"projects":{"name":"projects","type":"\u0019\u001bclaude.code.project","title":"Projects Claude Code has access to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"role":{"name":"role","type":"\u0007","title":"Account role within the organization","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional, null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"settings":{"name":"settings","type":"\n","title":"Settings dictionary","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bclaude.code.skill","title":"Claude Code skill","desc":"Single skill available to Claude Code. Exposes the skill `name` and `description`, the `allowedTools` it may invoke, its `source` path, the full `content` of the definition, and a `sha256` of that content for integrity checks.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bclaude.code.skill","title":"Configured skills","provider":"go.mondoo.com/cnquery/v9/providers/os"},"subscription":{"name":"subscription","type":"\u0007","title":"Subscription type","provider":"go.mondoo.com/cnquery/v9/providers/os"},"userId":{"name":"userId","type":"\u0007","title":"User ID","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Claude Code (Anthropic CLI agent) instance","desc":"Claude Code installation on the host, exposing the account it is signed into (`email`, `organization`, `role`, `subscription`), the installing `package` and host `runtime`, and the agent's configured surface: `enabledPlugins`, `plugins`, `skills`, `projects`, and `mcpServers`. Audit which plugins, skills, and MCP servers are configured, and which projects the agent can access. The `configPath` selects the configuration directory when it is not the default. URL: https://claude.ai/code","min_provider_version":"13.8.2","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"claude.code.mcpServer":{"id":"claude.code.mcpServer","name":"claude.code.mcpServer","fields":{"lastChecked":{"name":"lastChecked","type":"\u0007","is_mandatory":true,"title":"Timestamp of last authentication check","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Server name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"needsAuth":{"name":"needsAuth","type":"\u0004","is_mandatory":true,"title":"Whether the server needs authentication","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Claude Code MCP server","desc":"Single Model Context Protocol server configured for Claude Code. `name` identifies the server, `needsAuth` reports whether it requires authentication, and `lastChecked` is when its auth state was last verified.","private":true,"min_provider_version":"13.8.2","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"claude.code.plugin":{"id":"claude.code.plugin","name":"claude.code.plugin","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the plugin is currently enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"gitCommitSha":{"name":"gitCommitSha","type":"\u0007","is_mandatory":true,"title":"Git commit SHA of the installed version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installPath":{"name":"installPath","type":"\u0007","is_mandatory":true,"title":"Local install path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installedAt":{"name":"installedAt","type":"\u0007","is_mandatory":true,"title":"Installation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastUpdated":{"name":"lastUpdated","type":"\u0007","is_mandatory":true,"title":"Last updated timestamp","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Plugin name (e.g. \"gopls-lsp@claude-plugins-official\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Installation scope (user or project)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Plugin version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Claude Code installed plugin","desc":"Single plugin installed into Claude Code. Records the plugin `name`, `version`, install `scope` (user or project), on-disk `installPath`, install and update timestamps, the pinned `gitCommitSha`, and whether it is currently `enabled`.","private":true,"min_provider_version":"13.8.2","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"claude.code.project":{"id":"claude.code.project","name":"claude.code.project","fields":{"hasMemory":{"name":"hasMemory","type":"\u0004","is_mandatory":true,"title":"Whether the project has persistent memory configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Original filesystem path the project maps to","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Claude Code project","desc":"Single project directory Claude Code is configured to work in. `path` is the filesystem location and `hasMemory` reports whether persistent memory is configured for it.","private":true,"min_provider_version":"13.8.2","defaults":"path","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"claude.code.skill":{"id":"claude.code.skill","name":"claude.code.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full content of the skill definition","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Source path of the skill definition","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Claude Code skill","desc":"Single skill available to Claude Code. Exposes the skill `name` and `description`, the `allowedTools` it may invoke, its `source` path, the full `content` of the definition, and a `sha256` of that content for integrity checks.","private":true,"min_provider_version":"13.8.2","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"cline":{"id":"cline","name":"cline","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Cline configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional, null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bcline.skill","title":"Cline skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the agent. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bcline.skill","title":"Installed skills","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Cline AI agent instance","desc":"Cline AI coding agent installed on the host. Queryable through it are the installed skills (read from the shared ~/.agents/skills directory), along with the package that installed the agent and the runtime it executes in. URL: https://cline.bot/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"cline.skill":{"id":"cline.skill","name":"cline.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint describing the skill's expected arguments","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full markdown content of the skill definition","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content, for integrity checks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Cline skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the agent. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"cloud":{"id":"cloud","name":"cloud","fields":{"instance":{"name":"instance","type":"\u001bcloudInstance","title":"Cloud instance metadata","provider":"go.mondoo.com/cnquery/v9/providers/os"},"provider":{"name":"provider","type":"\u0007","title":"Cloud provider (e.g. aws, azure, gcp)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Cloud-asset metadata","desc":"Cloud provider hosting the asset and the instance metadata it exposes. The `provider` field names the platform (aws, azure, gcp), and `instance` reaches the per-instance metadata read from the cloud's metadata service.","min_provider_version":"11.3.32","defaults":"provider","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cloudInstance":{"id":"cloudInstance","name":"cloudInstance","fields":{"metadata":{"name":"metadata","type":"\n","title":"Raw access to the cloud instance metadata","provider":"go.mondoo.com/cnquery/v9/providers/os"},"privateHostname":{"name":"privateHostname","type":"\u0007","title":"Cloud instance private hostname","provider":"go.mondoo.com/cnquery/v9/providers/os"},"privateIpv4":{"name":"privateIpv4","type":"\u0019\u001bipAddress","title":"List of private IPv4 addresses","provider":"go.mondoo.com/cnquery/v9/providers/os"},"publicHostname":{"name":"publicHostname","type":"\u0007","title":"Cloud instance public hostname","provider":"go.mondoo.com/cnquery/v9/providers/os"},"publicIpv4":{"name":"publicIpv4","type":"\u0019\u001bipAddress","title":"List of public IPv4 addresses","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Cloud instance metadata","desc":"Per-instance identity and networking read from the cloud provider's instance metadata service: the public and private hostnames, the public and private IPv4 addresses, and the raw metadata document.","private":true,"min_provider_version":"11.3.32","defaults":"publicHostname privateHostname","provider":"go.mondoo.com/cnquery/v9/providers/os"},"command":{"id":"command","name":"command","fields":{"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Command string that was run","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exitcode":{"name":"exitcode","type":"\u0005","refs":["\"command\""],"title":"Exit code the command returned","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stderr":{"name":"stderr","type":"\u0007","refs":["\"command\""],"title":"Standard error output from running the command","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stdout":{"name":"stdout","type":"\u0007","refs":["\"command\""],"title":"Standard output from running the command","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"command","type":"\u0007"}]},"title":"Result of running a shell command on the system","desc":"Ad-hoc command execution as an MQL resource. Initialized with a shell command string; the resource executes the command through the connection (local exec, SSH, container exec, and similar) and surfaces the captured `stdout`, `stderr`, and `exitcode`. Used as a fall-back when there isn't a more specific resource for a piece of system state, and for assertions on tool versions or command-line probes.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"conda":{"id":"conda","fields":{"package":{"name":"package","type":"\u001bconda.package","title":"Conda package","desc":"Single conda package with its `name`, `version`, and `purl` (Package URL) for SBOM and vulnerability matching, plus the `files` that declared it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bconda.packages","title":"Conda package inventory","desc":"Installed conda packages discovered from `conda-meta` directories and `environment.yml` files. With no `path` set, scans common install locations (`/opt/conda`, per-user `miniconda3` and `anaconda3`, and app directories); pass `path` to target a specific project or environment. Each entry exposes name, version, and a `purl` for SBOM and vulnerability matching.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"conda.package":{"id":"conda.package","name":"conda.package","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files that declared the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Package name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl) identifying the package for SBOM and vulnerability matching","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Conda package","desc":"Single conda package with its `name`, `version`, and `purl` (Package URL) for SBOM and vulnerability matching, plus the `files` that declared it.","private":true,"min_provider_version":"13.13.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"conda.packages":{"id":"conda.packages","name":"conda.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Manifest and metadata files used to build the package list","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bconda.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Filesystem path searched for conda-meta or environment.yml (empty scans the default install locations)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bconda.package","title":"Conda package inventory","desc":"Installed conda packages discovered from `conda-meta` directories and `environment.yml` files. With no `path` set, scans common install locations (`/opt/conda`, per-user `miniconda3` and `anaconda3`, and app directories); pass `path` to target a specific project or environment. Each entry exposes name, version, and a `purl` for SBOM and vulnerability matching.","min_provider_version":"13.13.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"container":{"id":"container","fields":{"image":{"name":"image","type":"\u001bcontainer.image","title":"OCI/Docker container image reference","desc":"A container image reference broken into its parts: the raw `reference`, the fully-qualified `name`, the `identifier` (the tag or digest portion), the `identifierType` (`tag` or `digest`), and the source `repository`. Records exactly which image a running container or scan target was built from.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"repository":{"name":"repository","type":"\u001bcontainer.repository","title":"Container registry repository","desc":"The source repository of a container image, split into the `registry` host, the URL `scheme`, the repository `name`, and the `fullName` combining host and path. Identifies where an image is pulled from.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"container.image":{"id":"container.image","name":"container.image","fields":{"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"Type-specific portion of the image reference (the tag or digest value)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"identifierType":{"name":"identifierType","type":"\u0007","is_mandatory":true,"title":"Identifier type: `tag` or `digest`","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Fully-qualified reference name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"reference":{"name":"reference","type":"\u0007","is_mandatory":true,"title":"Original image reference as provided","provider":"go.mondoo.com/cnquery/v9/providers/os"},"repository":{"name":"repository","type":"\u001bcontainer.repository","title":"Repository the container image is pulled from","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"OCI/Docker container image reference","desc":"A container image reference broken into its parts: the raw `reference`, the fully-qualified `name`, the `identifier` (the tag or digest portion), the `identifierType` (`tag` or `digest`), and the source `repository`. Records exactly which image a running container or scan target was built from.","min_provider_version":"9.0.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"container.repository":{"id":"container.repository","name":"container.repository","fields":{"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Full repository name including the registry host","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Container registry repository name (path portion, without the registry host)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"registry":{"name":"registry","type":"\u0007","is_mandatory":true,"title":"Container registry host","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scheme":{"name":"scheme","type":"\u0007","is_mandatory":true,"title":"URL scheme (e.g., https)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Container registry repository","desc":"The source repository of a container image, split into the `registry` host, the URL `scheme`, the repository `name`, and the `fullName` combining host and path. Identifies where an image is pulled from.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"containerd":{"id":"containerd","name":"containerd","fields":{"container":{"name":"container","type":"\u001bcontainerd.container","title":"Single containerd container","desc":"A container managed by containerd, identified by `id` within its `namespace`, with its `image` reference, lifecycle `status`, process `pid`, `labels`, the `runtime` handling it (e.g. `io.containerd.runc.v2`), and the `snapshotter` providing its filesystem.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"containers":{"name":"containers","type":"\u0019\u001bcontainerd.container","title":"All containers across every containerd namespace","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"containerd host","desc":"Containers managed by the containerd runtime, gathered across all containerd namespaces via the `ctr` CLI. Use it to inventory workloads on hosts that run containerd directly (such as Kubernetes nodes) rather than through the Docker daemon.","min_provider_version":"11.4.84","provider":"go.mondoo.com/cnquery/v9/providers/os"},"containerd.container":{"id":"containerd.container","name":"containerd.container","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Container ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"image":{"name":"image","type":"\u0007","is_mandatory":true,"title":"Container image reference","provider":"go.mondoo.com/cnquery/v9/providers/os"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Container labels","provider":"go.mondoo.com/cnquery/v9/providers/os"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"containerd namespace the container belongs to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pid":{"name":"pid","type":"\u0005","is_mandatory":true,"title":"Process ID of the container's task, 0 when the container is not running","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u0007","is_mandatory":true,"title":"Container runtime (e.g., \"io.containerd.runc.v2\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"snapshotter":{"name":"snapshotter","type":"\u0007","is_mandatory":true,"title":"Container snapshotter","provider":"go.mondoo.com/cnquery/v9/providers/os"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Container status (created, running, paused, stopped, unknown)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Single containerd container","desc":"A container managed by containerd, identified by `id` within its `namespace`, with its `image` reference, lifecycle `status`, process `pid`, `labels`, the `runtime` handling it (e.g. `io.containerd.runc.v2`), and the `snapshotter` providing its filesystem.","min_provider_version":"11.4.84","defaults":"id status","provider":"go.mondoo.com/cnquery/v9/providers/os"},"continuedev":{"id":"continuedev","name":"continuedev","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Continue configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bcontinuedev.skill","title":"Continue skill","desc":"A single SKILL.md definition discovered for the Continue agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bcontinuedev.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Continue (open-source AI coding assistant) instance","desc":"Continue, an open-source AI coding assistant, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .continue in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://continue.dev/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"continuedev.skill":{"id":"continuedev.skill","name":"continuedev.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Continue skill","desc":"A single SKILL.md definition discovered for the Continue agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"crontab":{"id":"crontab","name":"crontab","fields":{"entries":{"name":"entries","type":"\u0019\u001bcrontab.entry","title":"All cron entries from system and user crontabs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entry":{"name":"entry","type":"\u001bcrontab.entry","title":"Individual crontab entry","desc":"Single scheduled job parsed from a crontab source. The five schedule fields (`minute`, `hour`, `dayOfMonth`, `month`, `dayOfWeek`) hold the raw cron expressions, `user` is the account the job runs as (taken from the entry for system crontabs, or from the filename for per-user crontabs), and `command` is the line executed. `file` and `lineNumber` locate the entry in its source.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"files":{"name":"files","type":"\u0019\u001bfile","title":"Files that contain crontab entries","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Crontab schedule on the system","desc":"Scheduled cron jobs collected from every source on the host: the system crontab (/etc/crontab), drop-in files under /etc/cron.d, and per-user crontabs (/var/spool/cron, /var/spool/cron/crontabs, /usr/lib/cron/tabs). The `entries` list shows what runs on a schedule, as which `user`, and with what `command`. Use `entries.where(user == \"root\")` to focus on privileged jobs. `files` lists the source files the entries were parsed from.","min_provider_version":"11.4.84","provider":"go.mondoo.com/cnquery/v9/providers/os"},"crontab.entry":{"id":"crontab.entry","name":"crontab.entry","fields":{"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Command to execute","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dayOfMonth":{"name":"dayOfMonth","type":"\u0007","is_mandatory":true,"title":"Day of month field (1-31, *, or cron expression)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dayOfWeek":{"name":"dayOfWeek","type":"\u0007","is_mandatory":true,"title":"Day of week field (0-7, *, or cron expression)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"File containing this entry","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hour":{"name":"hour","type":"\u0007","is_mandatory":true,"title":"Hour field (0-23, *, or cron expression)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the source file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"minute":{"name":"minute","type":"\u0007","is_mandatory":true,"title":"Minute field (0-59, *, or cron expression)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"month":{"name":"month","type":"\u0007","is_mandatory":true,"title":"Month field (1-12, *, or cron expression)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"User that runs the command","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Individual crontab entry","desc":"Single scheduled job parsed from a crontab source. The five schedule fields (`minute`, `hour`, `dayOfMonth`, `month`, `dayOfWeek`) hold the raw cron expressions, `user` is the account the job runs as (taken from the entry for system crontabs, or from the filename for per-user crontabs), and `command` is the line executed. `file` and `lineNumber` locate the entry in its source.","private":true,"min_provider_version":"11.4.84","defaults":"user command","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cursor":{"id":"cursor","name":"cursor","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Cursor configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mcpServer":{"name":"mcpServer","type":"\u001bcursor.mcpServer","title":"Cursor MCP server configuration","desc":"Model Context Protocol server Cursor is configured to use. Stdio servers run a local command; sse and streamable-http servers connect to a url. The hasEnv flag reports whether environment variables (often holding API keys or tokens) are configured for the server.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"mcpServers":{"name":"mcpServers","type":"\u0019\u001bcursor.mcpServer","title":"MCP servers the editor connects to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rule":{"name":"rule","type":"\u001bcursor.rule","title":"Cursor rule file","desc":"Rule file that injects standing instructions into the Cursor assistant's context, either globally or scoped to a project. The content field holds the full rule text, which shapes how the AI behaves and is worth reviewing for injected or unexpected directives.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"rules":{"name":"rules","type":"\u0019\u001bcursor.rule","title":"Cursor rules (global and project-scoped) that steer the assistant","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional, null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bcursor.skill","title":"Cursor skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the assistant. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bcursor.skill","title":"Installed skills","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Cursor editor (AI-powered) instance","desc":"Cursor AI code editor installed on the host. Queryable through it are the configured MCP servers, the global and project rules that steer the assistant, and any installed skills, along with the package that installed the editor and the runtime it executes in. Useful for auditing what tools and instructions govern the AI assistant. URL: https://www.cursor.com/","min_provider_version":"13.10.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"cursor.mcpServer":{"id":"cursor.mcpServer","name":"cursor.mcpServer","fields":{"args":{"name":"args","type":"\u0019\u0007","is_mandatory":true,"title":"Command-line arguments passed to the server command","provider":"go.mondoo.com/cnquery/v9/providers/os"},"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Local command launched for stdio-type servers","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hasEnv":{"name":"hasEnv","type":"\u0004","is_mandatory":true,"title":"Whether environment variables (for example API keys) are configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Server name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Endpoint URL for sse or streamable-http servers","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Cursor MCP server configuration","desc":"Model Context Protocol server Cursor is configured to use. Stdio servers run a local command; sse and streamable-http servers connect to a url. The hasEnv flag reports whether environment variables (often holding API keys or tokens) are configured for the server.","private":true,"min_provider_version":"13.10.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"cursor.rule":{"id":"cursor.rule","name":"cursor.rule","fields":{"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full content of the rule file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name (derived from filename)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Path to the rule file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Cursor rule file","desc":"Rule file that injects standing instructions into the Cursor assistant's context, either globally or scoped to a project. The content field holds the full rule text, which shapes how the AI behaves and is worth reviewing for injected or unexpected directives.","private":true,"min_provider_version":"13.10.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"cursor.skill":{"id":"cursor.skill","name":"cursor.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint describing the skill's expected arguments","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full markdown content of the skill definition","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content, for integrity checks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Cursor skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the assistant. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","private":true,"min_provider_version":"13.10.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"dart":{"id":"dart","fields":{"package":{"name":"package","type":"\u001bdart.package","title":"Dart/Flutter package dependency","desc":"Single Dart or Flutter package in the software inventory, exposing its unique `id`, `name`, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the lock files that declared it.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bdart.packages","title":"Dart/Flutter package inventory","desc":"Dart and Flutter packages resolved from a project's pubspec.lock, covering the root project, its direct dependencies, and the full transitive dependency tree. Set `path` to the directory holding the pubspec.lock.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"dart.package":{"id":"dart.package","name":"dart.package","fields":{"cpes":{"name":"cpes","type":"\u0019\u001bcpe","title":"Common Platform Enumeration (CPE) identifiers for matching against vulnerability advisories","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Lock files that contributed this package to the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the package within the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Package name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl), a standardized identifier for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Resolved package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dart/Flutter package dependency","desc":"Single Dart or Flutter package in the software inventory, exposing its unique `id`, `name`, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the lock files that declared it.","min_provider_version":"13.13.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dart.packages":{"id":"dart.packages","name":"dart.packages","fields":{"directDependencies":{"name":"directDependencies","type":"\u0019\u001bdart.package","title":"List of direct dependencies","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bdart.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for pubspec.lock","provider":"go.mondoo.com/cnquery/v9/providers/os"},"root":{"name":"root","type":"\u001bdart.package","title":"Root project (may not exist)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bdart.package","title":"Dart/Flutter package inventory","desc":"Dart and Flutter packages resolved from a project's pubspec.lock, covering the root project, its direct dependencies, and the full transitive dependency tree. Set `path` to the directory holding the pubspec.lock.","min_provider_version":"13.13.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker":{"id":"docker","name":"docker","fields":{"container":{"name":"container","type":"\u001bdocker.container","title":"Single Docker container on the host","desc":"A container on the Docker host, running or stopped, with its `state`, `status`, source `image`, startup `command`, `labels`, and the embedded Linux operating system running inside it (queryable through `os`). `hostConfig` exposes the daemon-side runtime settings such as privilege, capabilities, and mounts. Filter by state, for example `docker.containers.where(state == \"running\")`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"containers":{"name":"containers","type":"\u0019\u001bdocker.container","title":"All Docker containers on the host, running and stopped","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bdocker.file","title":"Dockerfile parser","desc":"Parsed contents of a Dockerfile, giving structured access to every build instruction rather than the raw text. The `stages` field breaks a multi-stage build into its `FROM`/`RUN`/`COPY`/`ENV`/`EXPOSE`/`USER`/ `HEALTHCHECK` instructions, `instructions` returns them in file order, and `finalStage` points at the stage that produces the image. Select a file with `docker.file(path: \"/path/to/Dockerfile\")` and audit it, for example `docker.file(\"Dockerfile\").stages.all(runsAsRoot == false)`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"image":{"name":"image","type":"\u001bdocker.image","title":"Single Docker image on the host","desc":"An image stored on the Docker host, with its content-addressable `id`, the `tags` and `repoDigests` it is known by, its `size`, and its `labels`. Use it to inventory images and check provenance, for example `docker.images.where(tags.none(_ == /latest/))` to find images not pinned to a floating tag.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"images":{"name":"images","type":"\u0019\u001bdocker.image","title":"All Docker images stored on the host","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Docker host","desc":"Images and containers managed by the local Docker daemon. The `images` field lists every image stored on the host with its ID, tags, digests, size, and labels; `containers` lists running and stopped containers with their state, image, command, and labels. Use it to audit what is deployed on a Docker host, for example `docker.containers.where(status == /Up/)` for currently running workloads.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.container":{"id":"docker.container","name":"docker.container","fields":{"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Command the container runs as its main process","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hostConfig":{"name":"hostConfig","type":"\n","title":"Host-dependent runtime configuration","desc":"The daemon-side `HostConfig` from container inspection, covering privilege (`Privileged`), added/dropped Linux capabilities, `NetworkMode`, port bindings, bind mounts, and restart policy. Central to container-hardening audits, for example checking `hostConfig[\"Privileged\"] == false`.","min_provider_version":"11.3.42","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Container ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"image":{"name":"image","type":"\u0007","is_mandatory":true,"title":"Image reference the container was created from (`repo:tag`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"imageid":{"name":"imageid","type":"\u0007","is_mandatory":true,"title":"ID of the image the container was created from","provider":"go.mondoo.com/cnquery/v9/providers/os"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Container labels, as key/value pairs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"names":{"name":"names","type":"\u0019\u0007","is_mandatory":true,"title":"Names assigned to the container (leading `/` stripped)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os":{"name":"os","type":"\u001bos.linux","provider":"go.mondoo.com/cnquery/v9/providers/os","is_embedded":true},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Container lifecycle state (e.g., created, running, paused, restarting, exited, dead)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Human-readable status message (e.g., \"Up 3 hours\", \"Exited (0) 2 days ago\")","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Single Docker container on the host","desc":"A container on the Docker host, running or stopped, with its `state`, `status`, source `image`, startup `command`, `labels`, and the embedded Linux operating system running inside it (queryable through `os`). `hostConfig` exposes the daemon-side runtime settings such as privilege, capabilities, and mounts. Filter by state, for example `docker.containers.where(state == \"running\")`.","min_provider_version":"9.0.0","defaults":"names.first status","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file":{"id":"docker.file","name":"docker.file","fields":{"add":{"name":"add","type":"\u001bdocker.file.add","title":"Dockerfile ADD instruction","desc":"Files brought into the image with `ADD`, which unlike `COPY` can fetch remote URLs and auto-extract archives. The `checksum` and `excludes` flags, plus the remote-fetch capability, make `ADD` a frequent audit target.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"arg":{"name":"arg","type":"\u001bdocker.file.arg","title":"Dockerfile ARG instruction","desc":"A build argument declared with `ARG`, giving its `name` and optional `default` value. Build arguments are commonly misused to pass secrets, so their names are worth auditing.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"copy":{"name":"copy","type":"\u001bdocker.file.copy","title":"Dockerfile COPY instruction","desc":"Files copied into the image with `COPY`, including cross-stage and cross-image copies via `--from`. Auditing `from` reveals which build stages or external images contribute files to the final image.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"directives":{"name":"directives","type":"\u001a\u0007\u0007","refs":["\"file\""],"title":"Parser directives declared at the top of the Dockerfile","desc":"Keys include `syntax` (frontend image pin, e.g. `docker/dockerfile:1.7`), `escape` (line-continuation token, default `\\`), and `check` (Buildkit build-check toggles).","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"env":{"name":"env","type":"\u001bdocker.file.env","title":"Dockerfile ENV instruction","desc":"An environment variable declared with `ENV`, as a `name`/`value` pair. Because `ENV` values persist into the running container and image history, they are a frequent place for accidentally baked-in secrets.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"expose":{"name":"expose","type":"\u001bdocker.file.expose","title":"Dockerfile EXPOSE instruction","desc":"A network port advertised by `EXPOSE`, with its `port` number and `protocol`. This documents intended listening ports, useful for reconciling against what a container actually binds.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"file":{"name":"file","type":"\u001bfile","title":"File information about this Dockerfile","provider":"go.mondoo.com/cnquery/v9/providers/os","is_embedded":true},"finalStage":{"name":"finalStage","type":"\u001bdocker.file.stage","refs":["\"file\""],"title":"Final stage in this Dockerfile","desc":"Shortcut to the last `docker.file.stage`, which is the one that produces the image when the build runs without `--target`. Null for an empty file.","min_provider_version":"13.21.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"from":{"name":"from","type":"\u001bdocker.file.from","title":"Dockerfile FROM instruction","desc":"The base image a stage is built from, parsed into its `image`, `tag`, `digest`, and optional `platform`, plus the stage `name` when written as `FROM ... AS \u003cname\u003e`. Pinning by `digest` rather than a floating `tag` is a common supply-chain requirement.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"hasSyntaxDirective":{"name":"hasSyntaxDirective","type":"\u0004","refs":["\"file\""],"title":"Whether the Dockerfile pins a frontend via the `syntax` parser directive","desc":"Set when the file begins with `# syntax=\u003cimage\u003e` (e.g. `# syntax=docker/dockerfile:1.7`). The directive selects a specific BuildKit frontend version. Note that BuildKit-only features such as `RUN --mount=type=secret` work without this directive too, so `false` does not mean BuildKit is unused.","min_provider_version":"13.21.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"healthcheck":{"name":"healthcheck","type":"\u001bdocker.file.healthcheck","title":"Dockerfile HEALTHCHECK instruction","desc":"The container health probe declared with `HEALTHCHECK`: the `test` command and its timing parameters (`interval`, `timeout`, `startPeriod`, `retries`). `none` is true for `HEALTHCHECK NONE`, which disables any inherited check.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"instructions":{"name":"instructions","type":"\n","refs":["\"file\""],"title":"All instructions in the order they appear in the file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"multiStage":{"name":"multiStage","type":"\u0004","refs":["\"file\""],"title":"Whether the Dockerfile defines more than one stage","min_provider_version":"13.21.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"oci":{"name":"oci","type":"\u001bdocker.file.oci","title":"OpenContainer image annotations declared in a build stage","desc":"The `org.opencontainers.image.*` labels set via `LABEL` instructions in a single build stage. The standard annotations defined by the OpenContainer image specification are surfaced as named fields so you can read provenance and metadata without remembering the full annotation keys, for example the upstream repository (`source`), the commit it was built from (`revision`), the release (`version`), and the SPDX license expression (`licenses`). The `all` field holds every `org.opencontainers.*` label found on the stage, including vendor-specific annotations that have no named field. A field is empty when its annotation is not declared in the stage. Surrounding quotes are removed from values, so a quoted `LABEL` reads back unquoted; the verbatim form remains available in the stage `labels` map.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"onbuild":{"name":"onbuild","type":"\u001bdocker.file.onbuild","title":"Dockerfile ONBUILD instruction","desc":"A trigger instruction registered with `ONBUILD` that runs later, when an image built from this Dockerfile is used as the base of a downstream build.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"run":{"name":"run","type":"\u001bdocker.file.run","title":"Dockerfile RUN instruction","desc":"A command executed at build time via `RUN`, with the raw `script`, its BuildKit flags (`mounts`, `network`, `security`), the shell-versus-exec form, and a parsed `commands` breakdown. Use `commands` to audit the programs invoked and their options, and `mountsSecret`/`mountsSsh` to spot build-time credential handling.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"shell":{"name":"shell","type":"\u001bdocker.file.shell","title":"Dockerfile SHELL instruction","desc":"The default shell used for shell-form `RUN`, `CMD`, and `ENTRYPOINT` instructions, as set by `SHELL`. Adding `-o pipefail` here is a common hardening step.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"stage":{"name":"stage","type":"\u001bdocker.file.stage","title":"Build stage in a Dockerfile","desc":"One `FROM`-rooted stage of a Dockerfile, with every instruction it contains exposed as a field: base image (`from`), environment (`env`), build arguments (`arg`), labels, commands (`run`, `cmd`, `entrypoint`), file operations (`add`, `copy`), exposed ports, health checks, volumes, and the effective user. The `runsAsRoot`, `hasHealthcheck`, and `final` predicates support common hardening audits such as checking that no stage runs as root.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"stages":{"name":"stages","type":"\u0019\u001bdocker.file.stage","refs":["\"file\""],"title":"Build stages defined in this Dockerfile","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stopsignal":{"name":"stopsignal","type":"\u001bdocker.file.stopsignal","title":"Dockerfile STOPSIGNAL instruction","desc":"The signal Docker sends to the container's main process on stop, as declared by `STOPSIGNAL`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"user":{"name":"user","type":"\u001bdocker.file.user","title":"Dockerfile USER instruction","desc":"The identity a stage switches to via `USER`, split into `user` and optional `group`, with `isRoot` flagging containers that would run privileged.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"volume":{"name":"volume","type":"\u001bdocker.file.volume","title":"Dockerfile VOLUME instruction","desc":"A mount point declared with `VOLUME`, whose contents are excluded from image layers and persist outside the container.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"workdir":{"name":"workdir","type":"\u001bdocker.file.workdir","title":"Dockerfile WORKDIR instruction","desc":"The working directory set by `WORKDIR` for subsequent instructions and the container's default directory at runtime.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"Dockerfile parser","desc":"Parsed contents of a Dockerfile, giving structured access to every build instruction rather than the raw text. The `stages` field breaks a multi-stage build into its `FROM`/`RUN`/`COPY`/`ENV`/`EXPOSE`/`USER`/ `HEALTHCHECK` instructions, `instructions` returns them in file order, and `finalStage` points at the stage that produces the image. Select a file with `docker.file(path: \"/path/to/Dockerfile\")` and audit it, for example `docker.file(\"Dockerfile\").stages.all(runsAsRoot == false)`.","min_provider_version":"11.0.2","defaults":"file.path instructions.length stages.length","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.add":{"id":"docker.file.add","name":"docker.file.add","fields":{"checksum":{"name":"checksum","type":"\u0007","is_mandatory":true,"title":"SHA256 digest the remote download must match (`--checksum=sha256:...`)","desc":"Empty when the flag is not set. Frequently required by audit policies to prevent unverified remote tarballs from entering the image.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chmod":{"name":"chmod","type":"\u0007","is_mandatory":true,"title":"Permissions applied to the copied files (`--chmod=\u003coctal\u003e`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chown":{"name":"chown","type":"\u0007","is_mandatory":true,"title":"Ownership applied to the copied files (`--chown=\u003cuser\u003e:\u003cgroup\u003e`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dst":{"name":"dst","type":"\u0007","is_mandatory":true,"title":"Destination path in the image","provider":"go.mondoo.com/cnquery/v9/providers/os"},"excludes":{"name":"excludes","type":"\u0019\u0007","is_mandatory":true,"title":"Patterns excluded from the copy (`--exclude=\u003cpattern\u003e`)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"link":{"name":"link","type":"\u0004","is_mandatory":true,"title":"Whether `--link` was set, enabling cache-friendly layered copies","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"src":{"name":"src","type":"\u0019\u0007","is_mandatory":true,"title":"Source paths, URLs, or archives to add","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile ADD instruction","desc":"Files brought into the image with `ADD`, which unlike `COPY` can fetch remote URLs and auto-extract archives. The `checksum` and `excludes` flags, plus the remote-fetch capability, make `ADD` a frequent audit target.","private":true,"min_provider_version":"11.0.2","defaults":"src dst","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.arg":{"id":"docker.file.arg","name":"docker.file.arg","fields":{"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"default":{"name":"default","type":"\u0007","is_mandatory":true,"title":"(optional) Default value of the variable","desc":"Values are preserved as-is, without stripping quotes.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the variable","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile ARG instruction","desc":"A build argument declared with `ARG`, giving its `name` and optional `default` value. Build arguments are commonly misused to pass secrets, so their names are worth auditing.","private":true,"min_provider_version":"11.4.70","defaults":"name default","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.copy":{"id":"docker.file.copy","name":"docker.file.copy","fields":{"chmod":{"name":"chmod","type":"\u0007","is_mandatory":true,"title":"Octal permissions of the file(s)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chown":{"name":"chown","type":"\u0007","is_mandatory":true,"title":"Ownership of the file(s)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dst":{"name":"dst","type":"\u0007","is_mandatory":true,"title":"The destination in the image for the file(s)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"excludes":{"name":"excludes","type":"\u0019\u0007","is_mandatory":true,"title":"Patterns excluded from the copy (`--exclude=\u003cpattern\u003e`)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"from":{"name":"from","type":"\u0007","is_mandatory":true,"title":"Stage or image to copy from (`--from=\u003cname\u003e`)","desc":"Set when `COPY --from=\u003cstage\u003e` references the output of an earlier multi-stage build or an external image such as `nginx:1.27`.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"link":{"name":"link","type":"\u0004","is_mandatory":true,"title":"Whether `--link` was set, enabling cache-friendly layered copies","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parents":{"name":"parents","type":"\u0004","is_mandatory":true,"title":"Whether `--parents` was set to preserve source directory structure","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"src":{"name":"src","type":"\u0019\u0007","is_mandatory":true,"title":"Optional source to copy file(s) from when not using the default build context","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile COPY instruction","desc":"Files copied into the image with `COPY`, including cross-stage and cross-image copies via `--from`. Auditing `from` reveals which build stages or external images contribute files to the final image.","private":true,"min_provider_version":"11.0.2","defaults":"src dst","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.env":{"id":"docker.file.env","name":"docker.file.env","fields":{"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the variable","provider":"go.mondoo.com/cnquery/v9/providers/os"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Value of the variable","desc":"Values are preserved as-is, without stripping quotes.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile ENV instruction","desc":"An environment variable declared with `ENV`, as a `name`/`value` pair. Because `ENV` values persist into the running container and image history, they are a frequent place for accidentally baked-in secrets.","private":true,"min_provider_version":"11.4.70","defaults":"name value","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.expose":{"id":"docker.file.expose","name":"docker.file.expose","fields":{"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Port that is exposed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol that is exposed (evaluates to `tcp` if not specified)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile EXPOSE instruction","desc":"A network port advertised by `EXPOSE`, with its `port` number and `protocol`. This documents intended listening ports, useful for reconciling against what a container actually binds.","private":true,"min_provider_version":"11.0.3","defaults":"port protocol","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.from":{"id":"docker.file.from","name":"docker.file.from","fields":{"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"digest":{"name":"digest","type":"\u0007","is_mandatory":true,"title":"Image digest, e.g. `sha256:...`; empty when referenced by tag","provider":"go.mondoo.com/cnquery/v9/providers/os"},"image":{"name":"image","type":"\u0007","is_mandatory":true,"title":"Base image repository, e.g. `alpine` or `docker.io/library/nginx`","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Stage name from `FROM ... AS \u003cname\u003e`, empty for an unnamed stage","provider":"go.mondoo.com/cnquery/v9/providers/os"},"platform":{"name":"platform","type":"\u0007","is_mandatory":true,"title":"Target platform for the base image (`--platform=\u003cos\u003e/\u003carch\u003e`), empty when not set","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tag":{"name":"tag","type":"\u0007","is_mandatory":true,"title":"Image tag, e.g. `3.19`; empty when the image is pinned by digest only","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile FROM instruction","desc":"The base image a stage is built from, parsed into its `image`, `tag`, `digest`, and optional `platform`, plus the stage `name` when written as `FROM ... AS \u003cname\u003e`. Pinning by `digest` rather than a floating `tag` is a common supply-chain requirement.","private":true,"min_provider_version":"11.0.2","defaults":"name image tag","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.healthcheck":{"id":"docker.file.healthcheck","name":"docker.file.healthcheck","fields":{"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"interval":{"name":"interval","type":"\u0005","is_mandatory":true,"title":"Time between running the check in nanoseconds","provider":"go.mondoo.com/cnquery/v9/providers/os"},"none":{"name":"none","type":"\u0004","is_mandatory":true,"title":"Whether HEALTHCHECK is set to NONE (disables any inherited healthcheck)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"retries":{"name":"retries","type":"\u0005","is_mandatory":true,"title":"Number of consecutive failures needed to report unhealthy","provider":"go.mondoo.com/cnquery/v9/providers/os"},"startInterval":{"name":"startInterval","type":"\u0005","is_mandatory":true,"title":"Interval between checks during start period in nanoseconds","provider":"go.mondoo.com/cnquery/v9/providers/os"},"startPeriod":{"name":"startPeriod","type":"\u0005","is_mandatory":true,"title":"Start period for the container to initialize before counting retries in nanoseconds","provider":"go.mondoo.com/cnquery/v9/providers/os"},"test":{"name":"test","type":"\u0019\u0007","is_mandatory":true,"title":"The health check test command (e.g., [\"CMD-SHELL\", \"curl -f http://localhost/ || exit 1\"])","provider":"go.mondoo.com/cnquery/v9/providers/os"},"timeout":{"name":"timeout","type":"\u0005","is_mandatory":true,"title":"Time to wait before considering the check hung in nanoseconds","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile HEALTHCHECK instruction","desc":"The container health probe declared with `HEALTHCHECK`: the `test` command and its timing parameters (`interval`, `timeout`, `startPeriod`, `retries`). `none` is true for `HEALTHCHECK NONE`, which disables any inherited check.","private":true,"min_provider_version":"11.8.14","defaults":"test","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.oci":{"id":"docker.file.oci","name":"docker.file.oci","fields":{"all":{"name":"all","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Every `org.opencontainers.*` label on the stage, keyed by full annotation name","desc":"Includes the standard annotations surfaced as named fields as well as any vendor-specific or non-standard annotations under the `org.opencontainers` namespace.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"authors":{"name":"authors","type":"\u0007","is_mandatory":true,"title":"Contact details of the people or organization responsible for the image (`org.opencontainers.image.authors`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"baseDigest":{"name":"baseDigest","type":"\u0007","is_mandatory":true,"title":"Digest of the base image this image was built on (`org.opencontainers.image.base.digest`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"baseName":{"name":"baseName","type":"\u0007","is_mandatory":true,"title":"Image reference of the base image this image was built on (`org.opencontainers.image.base.name`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"created":{"name":"created","type":"\u0007","is_mandatory":true,"title":"Date and time the image was built, as an RFC 3339 string (`org.opencontainers.image.created`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description of the software packaged in the image (`org.opencontainers.image.description`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"documentation":{"name":"documentation","type":"\u0007","is_mandatory":true,"title":"URL to get documentation about the image (`org.opencontainers.image.documentation`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"licenses":{"name":"licenses","type":"\u0007","is_mandatory":true,"title":"License(s) under which the contained software is distributed (`org.opencontainers.image.licenses`)","desc":"An SPDX license expression, for example `Apache-2.0` or `MIT OR GPL-2.0-only`.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"refName":{"name":"refName","type":"\u0007","is_mandatory":true,"title":"Name of the reference for the image's target (`org.opencontainers.image.ref.name`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"revision":{"name":"revision","type":"\u0007","is_mandatory":true,"title":"Source control revision the image was built from (`org.opencontainers.image.revision`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"URL to the source code that built the image (`org.opencontainers.image.source`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Human-readable title of the image (`org.opencontainers.image.title`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"URL to find more information about the image (`org.opencontainers.image.url`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vendor":{"name":"vendor","type":"\u0007","is_mandatory":true,"title":"Name of the distributing entity, organization, or individual (`org.opencontainers.image.vendor`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Version of the packaged software (`org.opencontainers.image.version`)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"OpenContainer image annotations declared in a build stage","desc":"The `org.opencontainers.image.*` labels set via `LABEL` instructions in a single build stage. The standard annotations defined by the OpenContainer image specification are surfaced as named fields so you can read provenance and metadata without remembering the full annotation keys, for example the upstream repository (`source`), the commit it was built from (`revision`), the release (`version`), and the SPDX license expression (`licenses`). The `all` field holds every `org.opencontainers.*` label found on the stage, including vendor-specific annotations that have no named field. A field is empty when its annotation is not declared in the stage. Surrounding quotes are removed from values, so a quoted `LABEL` reads back unquoted; the verbatim form remains available in the stage `labels` map.","private":true,"min_provider_version":"13.25.1","defaults":"source version revision","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.onbuild":{"id":"docker.file.onbuild","name":"docker.file.onbuild","fields":{"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"expression":{"name":"expression","type":"\u0007","is_mandatory":true,"title":"The triggered instruction, exactly as written after `ONBUILD`","desc":"For example `ONBUILD COPY . /app/src` yields `COPY . /app/src`.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile ONBUILD instruction","desc":"A trigger instruction registered with `ONBUILD` that runs later, when an image built from this Dockerfile is used as the base of a downstream build.","private":true,"min_provider_version":"13.16.10","defaults":"expression","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.run":{"id":"docker.file.run","name":"docker.file.run","fields":{"command":{"name":"command","type":"\u001bdocker.file.run.command","title":"Single command parsed from a Dockerfile RUN, CMD, or ENTRYPOINT","desc":"One entry per command in the instruction's shell pipeline. Select the program with `binary` and, for tools with subcommands, `subcommand`, for example `binary == \"apt-get\"` and `subcommand == \"install\"`, then inspect `flags` for required options such as `--no-install-recommends`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"commands":{"name":"commands","type":"\u0019\u001bdocker.file.run.command","is_mandatory":true,"title":"Individual commands parsed from the instruction","desc":"The script split on the shell operators `\u0026\u0026`, `||`, `;`, and `|` (and newlines) into separate commands, each tokenized into its executable and arguments with leading `VAR=value` assignments removed. Exec-form instructions yield a single command from the argv. Use this to audit the program invoked and its options instead of substring-matching the raw `script`. Parsing is best-effort: it does not descend into subshells or command substitutions, and redirections (`\u003e`, `\u003e\u003e`, `\u003c`, `2\u003e\u00261`) appear as ordinary tokens in the following command's `args`.","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isExecForm":{"name":"isExecForm","type":"\u0004","is_mandatory":true,"title":"Whether the instruction is written in exec form","desc":"Exec form (`RUN [\"echo\", \"hi\"]`) executes the program directly without a shell, so pipes, redirects, and `${VAR}` expansion are not interpreted.","min_provider_version":"13.21.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isShellForm":{"name":"isShellForm","type":"\u0004","is_mandatory":true,"title":"Whether the instruction is written in shell form","desc":"Shell form (`RUN echo hi`) wraps the command in the stage `SHELL` (default `/bin/sh -c`), allowing shell expansion, pipes, and variable substitution.","min_provider_version":"13.21.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mount":{"name":"mount","type":"\u001bdocker.file.run.mount","title":"Dockerfile RUN --mount flag","desc":"One entry per `--mount=...` flag on a `RUN` instruction.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"mounts":{"name":"mounts","type":"\u0019\u001bdocker.file.run.mount","is_mandatory":true,"title":"`--mount=...` flags applied to this RUN","desc":"Each mount exposes a build-time secret, ssh agent socket, cache directory, tmpfs, or bind-mounted source.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mountsSecret":{"name":"mountsSecret","type":"\u0004","is_mandatory":true,"title":"Whether the instruction declares a `--mount=type=secret`","min_provider_version":"13.21.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mountsSsh":{"name":"mountsSsh","type":"\u0004","is_mandatory":true,"title":"Whether the instruction declares a `--mount=type=ssh`","min_provider_version":"13.21.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"network":{"name":"network","type":"\u0007","is_mandatory":true,"title":"`--network=...` value","desc":"One of `default`, `none`, or `host`. Empty when the flag is not set (BuildKit treats that as `default`).","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"script":{"name":"script","type":"\u0007","is_mandatory":true,"title":"Raw command text of the RUN instruction","provider":"go.mondoo.com/cnquery/v9/providers/os"},"security":{"name":"security","type":"\u0007","is_mandatory":true,"title":"`--security=...` value","desc":"One of `sandbox` or `insecure`. Empty when the flag is not set. `insecure` runs the step with elevated privileges and is commonly flagged by security policies.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile RUN instruction","desc":"A command executed at build time via `RUN`, with the raw `script`, its BuildKit flags (`mounts`, `network`, `security`), the shell-versus-exec form, and a parsed `commands` breakdown. Use `commands` to audit the programs invoked and their options, and `mountsSecret`/`mountsSsh` to spot build-time credential handling.","private":true,"min_provider_version":"11.0.2","defaults":"script","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.run.command":{"id":"docker.file.run.command","name":"docker.file.run.command","fields":{"args":{"name":"args","type":"\u0019\u0007","is_mandatory":true,"title":"All arguments after the executable, in the order they appear","provider":"go.mondoo.com/cnquery/v9/providers/os"},"binary":{"name":"binary","type":"\u0007","is_mandatory":true,"title":"Executable invoked, e.g. \"apt-get\", \"curl\", or \"npm\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"flags":{"name":"flags","type":"\u0019\u0007","is_mandatory":true,"title":"Dash-prefixed options, e.g. [\"--no-install-recommends\", \"-y\"]","desc":"A flag that carries an `=`-joined value is kept as one token, so `--mount=type=bind` matches `flags.contains(\"--mount=type=bind\")` or `flags.any(_.contains(\"--mount\"))`, not `flags.contains(\"--mount\")`.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"subcommand":{"name":"subcommand","type":"\u0007","is_mandatory":true,"title":"First non-flag argument, e.g. \"install\" or \"add\"","desc":"Empty when the command takes no subcommand. Resolved independently of flag position, so `apt-get -y install` and `apt-get install -y` both report `install`.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Single command parsed from a Dockerfile RUN, CMD, or ENTRYPOINT","desc":"One entry per command in the instruction's shell pipeline. Select the program with `binary` and, for tools with subcommands, `subcommand`, for example `binary == \"apt-get\"` and `subcommand == \"install\"`, then inspect `flags` for required options such as `--no-install-recommends`.","private":true,"min_provider_version":"13.25.1","defaults":"binary subcommand","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.run.mount":{"id":"docker.file.run.mount","name":"docker.file.run.mount","fields":{"env":{"name":"env","type":"\u0007","is_mandatory":true,"title":"Environment variable that exposes the secret to the RUN command","provider":"go.mondoo.com/cnquery/v9/providers/os"},"from":{"name":"from","type":"\u0007","is_mandatory":true,"title":"Stage or image to bind-mount from (`--from=\u003cname\u003e`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"gid":{"name":"gid","type":"\u0005","is_mandatory":true,"title":"Owner GID for secret / ssh mounts","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Identifier","desc":"For `cache` mounts this is the cache id; for `secret` and `ssh` mounts this is the secret/ssh id supplied via `id=...`.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mode":{"name":"mode","type":"\u0005","is_mandatory":true,"title":"File mode for secret / ssh mounts (octal)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"readOnly":{"name":"readOnly","type":"\u0004","is_mandatory":true,"title":"Whether the mount is read-only","provider":"go.mondoo.com/cnquery/v9/providers/os"},"required":{"name":"required","type":"\u0004","is_mandatory":true,"title":"Whether the secret or ssh mount is required to exist at build time","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sharing":{"name":"sharing","type":"\u0007","is_mandatory":true,"title":"Cache sharing mode","desc":"For `cache` mounts: `shared`, `private`, or `locked`. Empty for other types.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sizeLimit":{"name":"sizeLimit","type":"\u0005","is_mandatory":true,"title":"Tmpfs size limit in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Source path or context for `bind` and `cache` mounts","provider":"go.mondoo.com/cnquery/v9/providers/os"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"Mount destination inside the build container","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Mount type","desc":"One of `bind`, `cache`, `secret`, `ssh`, or `tmpfs`.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uid":{"name":"uid","type":"\u0005","is_mandatory":true,"title":"Owner UID for secret / ssh mounts","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile RUN --mount flag","desc":"One entry per `--mount=...` flag on a `RUN` instruction.","private":true,"min_provider_version":"13.16.10","defaults":"type target","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.shell":{"id":"docker.file.shell","name":"docker.file.shell","fields":{"command":{"name":"command","type":"\u0019\u0007","is_mandatory":true,"title":"Shell executable and flags (e.g., [\"/bin/bash\", \"-o\", \"pipefail\", \"-c\"])","provider":"go.mondoo.com/cnquery/v9/providers/os"},"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile SHELL instruction","desc":"The default shell used for shell-form `RUN`, `CMD`, and `ENTRYPOINT` instructions, as set by `SHELL`. Adding `-o pipefail` here is a common hardening step.","private":true,"min_provider_version":"11.8.15","defaults":"command","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.stage":{"id":"docker.file.stage","name":"docker.file.stage","fields":{"add":{"name":"add","type":"\u0019\u001bdocker.file.add","is_mandatory":true,"title":"ADD instructions in this stage","provider":"go.mondoo.com/cnquery/v9/providers/os"},"arg":{"name":"arg","type":"\u0019\u001bdocker.file.arg","is_mandatory":true,"title":"ARG instructions in this stage","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cmd":{"name":"cmd","type":"\u001bdocker.file.run","is_mandatory":true,"title":"CMD instruction in this stage","provider":"go.mondoo.com/cnquery/v9/providers/os"},"copy":{"name":"copy","type":"\u0019\u001bdocker.file.copy","is_mandatory":true,"title":"COPY instructions in this stage","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entrypoint":{"name":"entrypoint","type":"\u001bdocker.file.run","is_mandatory":true,"title":"ENTRYPOINT instruction in this stage","provider":"go.mondoo.com/cnquery/v9/providers/os"},"env":{"name":"env","type":"\u0019\u001bdocker.file.env","is_mandatory":true,"title":"ENV instructions in this stage","min_provider_version":"11.4.86","provider":"go.mondoo.com/cnquery/v9/providers/os"},"expose":{"name":"expose","type":"\u0019\u001bdocker.file.expose","is_mandatory":true,"title":"EXPOSE instructions in this stage","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bdocker.file","is_mandatory":true,"title":"Dockerfile this stage belongs to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"final":{"name":"final","type":"\u0004","is_mandatory":true,"title":"Whether this stage is the final stage in the Dockerfile","desc":"Only the final stage produces the image when the Dockerfile is built without `--target`.","min_provider_version":"13.21.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"from":{"name":"from","type":"\u001bdocker.file.from","is_mandatory":true,"title":"Base image this stage builds on, from its `FROM` instruction","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hasHealthcheck":{"name":"hasHealthcheck","type":"\u0004","is_mandatory":true,"title":"Whether this stage declares a HEALTHCHECK","desc":"True for any `HEALTHCHECK` line, including `HEALTHCHECK NONE` (which explicitly disables an inherited check).","min_provider_version":"13.21.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"healthcheck":{"name":"healthcheck","type":"\u001bdocker.file.healthcheck","is_mandatory":true,"title":"HEALTHCHECK instruction in this stage","min_provider_version":"11.8.14","provider":"go.mondoo.com/cnquery/v9/providers/os"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"LABEL instructions in this stage, as key/value pairs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"oci":{"name":"oci","type":"\u001bdocker.file.oci","is_mandatory":true,"title":"OpenContainer image annotations parsed from this stage's labels","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"onbuild":{"name":"onbuild","type":"\u0019\u001bdocker.file.onbuild","is_mandatory":true,"title":"ONBUILD instructions in this stage","desc":"ONBUILD instructions are deferred and run when an image built from this Dockerfile is itself used as the base image of a downstream build.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"run":{"name":"run","type":"\u0019\u001bdocker.file.run","is_mandatory":true,"title":"RUN instructions in this stage","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","is_mandatory":true,"title":"Whether this stage runs as root","desc":"True when no `USER` instruction is present in the stage or when the declared user resolves to UID 0 (`0` or `root`). Inherited `USER` from the base image is not considered, because it is not visible from the Dockerfile alone.","min_provider_version":"13.21.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"shell":{"name":"shell","type":"\u001bdocker.file.shell","is_mandatory":true,"title":"SHELL instruction in this stage","min_provider_version":"11.8.15","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stopsignal":{"name":"stopsignal","type":"\u001bdocker.file.stopsignal","is_mandatory":true,"title":"STOPSIGNAL instruction in this stage","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user":{"name":"user","type":"\u001bdocker.file.user","is_mandatory":true,"title":"USER instruction in this stage","provider":"go.mondoo.com/cnquery/v9/providers/os"},"volumes":{"name":"volumes","type":"\u0019\u001bdocker.file.volume","is_mandatory":true,"title":"VOLUME instructions in this stage","min_provider_version":"11.8.14","provider":"go.mondoo.com/cnquery/v9/providers/os"},"workdir":{"name":"workdir","type":"\u0019\u001bdocker.file.workdir","is_mandatory":true,"title":"WORKDIR instructions in this stage","min_provider_version":"11.8.15","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Build stage in a Dockerfile","desc":"One `FROM`-rooted stage of a Dockerfile, with every instruction it contains exposed as a field: base image (`from`), environment (`env`), build arguments (`arg`), labels, commands (`run`, `cmd`, `entrypoint`), file operations (`add`, `copy`), exposed ports, health checks, volumes, and the effective user. The `runsAsRoot`, `hasHealthcheck`, and `final` predicates support common hardening audits such as checking that no stage runs as root.","private":true,"min_provider_version":"11.0.2","defaults":"from.name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.stopsignal":{"id":"docker.file.stopsignal","name":"docker.file.stopsignal","fields":{"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signal":{"name":"signal","type":"\u0007","is_mandatory":true,"title":"Signal name or number sent to the container on stop (e.g., `SIGTERM`, `9`)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile STOPSIGNAL instruction","desc":"The signal Docker sends to the container's main process on stop, as declared by `STOPSIGNAL`.","private":true,"min_provider_version":"13.16.10","defaults":"signal","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.user":{"id":"docker.file.user","name":"docker.file.user","fields":{"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"Group name or GID the stage switches to (optional)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isRoot":{"name":"isRoot","type":"\u0004","is_mandatory":true,"title":"Whether the declared user is root","desc":"True when `user` is `0` or `root`. The group is not considered.","min_provider_version":"13.21.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"User name or UID the stage switches to","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile USER instruction","desc":"The identity a stage switches to via `USER`, split into `user` and optional `group`, with `isRoot` flagging containers that would run privileged.","private":true,"min_provider_version":"11.1.3","defaults":"user","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.volume":{"id":"docker.file.volume","name":"docker.file.volume","fields":{"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Volume mount path","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile VOLUME instruction","desc":"A mount point declared with `VOLUME`, whose contents are excluded from image layers and persist outside the container.","private":true,"min_provider_version":"11.8.14","defaults":"path","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.file.workdir":{"id":"docker.file.workdir","name":"docker.file.workdir","fields":{"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.30.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Working directory path","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Dockerfile WORKDIR instruction","desc":"The working directory set by `WORKDIR` for subsequent instructions and the container's default directory at runtime.","private":true,"min_provider_version":"11.8.15","defaults":"path","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"docker.image":{"id":"docker.image","name":"docker.image","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Image ID, the content-addressable digest of the image config","provider":"go.mondoo.com/cnquery/v9/providers/os"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Image labels, as key/value pairs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"repoDigests":{"name":"repoDigests","type":"\u0019\u0007","is_mandatory":true,"title":"Repository digests (`repo@sha256:...`) the image is published under","min_provider_version":"11.4.52","provider":"go.mondoo.com/cnquery/v9/providers/os"},"size":{"name":"size","type":"\u0005","is_mandatory":true,"title":"Image size in bytes, including all layers","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Repository tags (`repo:tag`) referencing this image","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Single Docker image on the host","desc":"An image stored on the Docker host, with its content-addressable `id`, the `tags` and `repoDigests` it is known by, its `size`, and its `labels`. Use it to inventory images and check provenance, for example `docker.images.where(tags.none(_ == /latest/))` to find images not pinned to a floating tag.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dotnet":{"id":"dotnet","fields":{"package":{"name":"package","type":"\u001bdotnet.package","title":".NET / NuGet package dependency","desc":"Single .NET package in the software inventory, exposing its unique `id`, `name`, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the manifest or lock files that declared it.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bdotnet.packages","title":".NET / NuGet package inventory","desc":"NuGet packages resolved from a .NET project, covering the root project, its direct dependencies, and the full transitive dependency tree. Set `path` to point at a specific project or solution directory.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"dotnet.package":{"id":"dotnet.package","name":"dotnet.package","fields":{"cpes":{"name":"cpes","type":"\u0019\u001bcpe","title":"Common Platform Enumeration (CPE) identifiers for matching against vulnerability advisories","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Manifest and lock files that contributed this package to the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the package within the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Name of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl), a standardized identifier for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Resolved package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":".NET / NuGet package dependency","desc":"Single .NET package in the software inventory, exposing its unique `id`, `name`, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the manifest or lock files that declared it.","min_provider_version":"13.10.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dotnet.packages":{"id":"dotnet.packages","name":"dotnet.packages","fields":{"directDependencies":{"name":"directDependencies","type":"\u0019\u001bdotnet.package","title":"List of direct dependencies","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bdotnet.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for .NET package files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"root":{"name":"root","type":"\u001bdotnet.package","title":"Root project (may not exist)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bdotnet.package","title":".NET / NuGet package inventory","desc":"NuGet packages resolved from a .NET project, covering the root project, its direct dependencies, and the full transitive dependency tree. Set `path` to point at a specific project or solution directory.","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"elixir":{"id":"elixir","fields":{"package":{"name":"package","type":"\u001belixir.package","title":"Elixir Hex package dependency","desc":"Single Elixir Hex package locked in a mix.lock, exposing its unique `id`, `name`, `version`, `purl` identifier, and the lock files that declared it.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001belixir.packages","title":"Elixir Hex package inventory (mix.lock)","desc":"Elixir Hex packages locked in a project's mix.lock, each with its resolved version. Set `path` to the directory holding the mix.lock.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"elixir.package":{"id":"elixir.package","name":"elixir.package","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Lock files that contributed this package to the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the package within the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Package name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl), a standardized identifier for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Resolved package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Elixir Hex package dependency","desc":"Single Elixir Hex package locked in a mix.lock, exposing its unique `id`, `name`, `version`, `purl` identifier, and the lock files that declared it.","min_provider_version":"13.13.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"elixir.packages":{"id":"elixir.packages","name":"elixir.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001belixir.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for mix.lock","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001belixir.package","title":"Elixir Hex package inventory (mix.lock)","desc":"Elixir Hex packages locked in a project's mix.lock, each with its resolved version. Set `path` to the directory holding the mix.lock.","min_provider_version":"13.13.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"erlang":{"id":"erlang","fields":{"package":{"name":"package","type":"\u001berlang.package","title":"Erlang Hex package dependency","desc":"Single Erlang Hex package locked in a rebar.lock, exposing its unique `id`, `name`, `version`, `purl` identifier, and the lock files that declared it.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001berlang.packages","title":"Erlang Hex package inventory (rebar.lock)","desc":"Erlang Hex packages locked in a project's rebar.lock, each with its resolved version. Set `path` to the directory holding the rebar.lock.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"erlang.package":{"id":"erlang.package","name":"erlang.package","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Lock files that contributed this package to the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the package within the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Package name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl), a standardized identifier for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Resolved package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Erlang Hex package dependency","desc":"Single Erlang Hex package locked in a rebar.lock, exposing its unique `id`, `name`, `version`, `purl` identifier, and the lock files that declared it.","min_provider_version":"13.13.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"erlang.packages":{"id":"erlang.packages","name":"erlang.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001berlang.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for rebar.lock","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001berlang.package","title":"Erlang Hex package inventory (rebar.lock)","desc":"Erlang Hex packages locked in a project's rebar.lock, each with its resolved version. Set `path` to the directory holding the rebar.lock.","min_provider_version":"13.13.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exim":{"id":"exim","name":"exim","fields":{"configPath":{"name":"configPath","type":"\u0007","title":"Path to the active Exim configuration file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"localInterfaces":{"name":"localInterfaces","type":"\u0019\u0007","title":"Local interfaces parsed and normalized into a list","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","title":"Parsed macros and main-section options","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"Exim mail transfer agent configuration","desc":"Exim configuration. `params` holds the macros and main-section options parsed from the active config file, covering both the Debian `update-exim4.conf.conf` key/value form and the monolithic `exim.conf` main section (options before the first `begin` block). `localInterfaces` normalizes the local interface list, handling the Debian `dc_local_interfaces` `' ; '`-separated form and the Exim `local_interfaces` list, so policies can compare it directly. By default the per-distribution config location is used; select an alternate file with `exim(\"/path/to/exim.conf\")`.","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"extensionRuntime":{"id":"extensionRuntime","name":"extensionRuntime","fields":{"package":{"name":"package","type":"\u001bpackage","is_mandatory":true,"title":"Host software package","desc":"Host application or operating system represented as a package, carrying its version and package URL (purl) where known so it can be looked up in vulnerability data like any other installed software.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Host environment for an AI agent or editor extension","desc":"Runtime that hosts an AI coding agent or editor extension: the operating system for a standalone agent, the IDE or editor for an editor plugin, or the browser for a browser extension. The `package` field carries the host's software identity (version and package URL where known) so the host itself can be assessed for vulnerabilities like any other installed software.","private":true,"min_provider_version":"13.33.1","defaults":"package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"id":"file","name":"file","fields":{"basename":{"name":"basename","type":"\u0007","refs":["\"path\""],"title":"Filename without path prefix of this file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","refs":["\"path\"","\"exists\""],"title":"Contents of this file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"context":{"name":"context","type":"\u001bfile.context","title":"File context is a range of lines/columns in a file","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"dirname":{"name":"dirname","type":"\u0007","refs":["\"path\""],"title":"Path to the folder containing this file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"empty":{"name":"empty","type":"\u0004","refs":["\"path\""],"title":"Whether the path is empty","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exists":{"name":"exists","type":"\u0004","refs":["\"path\""],"title":"Whether this file exists on the system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"group":{"name":"group","type":"\u001bgroup","title":"Ownership information about the group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Location of the file on the system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"permissions":{"name":"permissions","type":"\u001bfile.permissions","refs":["\"path\""],"title":"Permissions for this file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"size":{"name":"size","type":"\u0005","refs":["\"path\""],"title":"Size of this file on disk in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user":{"name":"user","type":"\u001buser","title":"Ownership information about the user","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"File on the system","desc":"Single file referenced by absolute path. Surfaces the path itself, the basename and dirname, an `exists` flag, the `content` string, the file's size in bytes, an `empty` predicate, the owning `user` and `group` as references, and a structured `permissions` resource that explodes the POSIX mode into named user / group / other read / write / execute bits, the SUID / SGID / sticky bits, the `isFile` / `isDirectory` / `isSymlink` discriminators, and a printed mode string. The unit of file-level audits and the building block most config-file resources read through. Select a file by path, for example `file(\"/etc/ssh/sshd_config\")`.","min_provider_version":"9.0.0","defaults":"path size permissions.string","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file.context":{"id":"file.context","name":"file.context","fields":{"content":{"name":"content","type":"\u0007","refs":["\"file\"","\"range\""],"title":"Content for this range in the file, shown as an excerpt","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"File referenced by this file context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"range":{"name":"range","type":"\u001e","is_mandatory":true,"title":"Range of content in the file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"File context is a range of lines/columns in a file","private":true,"min_provider_version":"11.3.26","defaults":"file.path range content","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file.permissions":{"id":"file.permissions","name":"file.permissions","fields":{"group_executable":{"name":"group_executable","type":"\u0004","is_mandatory":true,"title":"Whether the file is executable by members of the group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"group_readable":{"name":"group_readable","type":"\u0004","is_mandatory":true,"title":"Whether the file is readable by members of the group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"group_writeable":{"name":"group_writeable","type":"\u0004","is_mandatory":true,"title":"Whether the file is writeable by members of the group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isDirectory":{"name":"isDirectory","type":"\u0004","is_mandatory":true,"title":"Whether the file describes a directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isFile":{"name":"isFile","type":"\u0004","is_mandatory":true,"title":"Whether the file describes a regular file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isSymlink":{"name":"isSymlink","type":"\u0004","is_mandatory":true,"title":"Whether the file is a symlink","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mode":{"name":"mode","type":"\u0005","is_mandatory":true,"title":"POSIX file mode as a decimal integer (e.g., 33188 = 0100644)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"other_executable":{"name":"other_executable","type":"\u0004","is_mandatory":true,"title":"Whether the file is executable by others","provider":"go.mondoo.com/cnquery/v9/providers/os"},"other_readable":{"name":"other_readable","type":"\u0004","is_mandatory":true,"title":"Whether the file is readable by others","provider":"go.mondoo.com/cnquery/v9/providers/os"},"other_writeable":{"name":"other_writeable","type":"\u0004","is_mandatory":true,"title":"Whether the file is writeable by others","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sgid":{"name":"sgid","type":"\u0004","is_mandatory":true,"title":"Whether the set-group-ID bit is set (executable runs with the group's privileges)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sticky":{"name":"sticky","type":"\u0004","is_mandatory":true,"title":"Whether the sticky bit is set (only a file's owner may delete it from a shared directory)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"string":{"name":"string","type":"\u0007","title":"Symbolic permission string in ls -l form (e.g., \"-rw-r--r--\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"suid":{"name":"suid","type":"\u0004","is_mandatory":true,"title":"Whether the set-user-ID bit is set (executable runs with the owner's privileges)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user_executable":{"name":"user_executable","type":"\u0004","is_mandatory":true,"title":"Whether the file is executable by its owner","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user_readable":{"name":"user_readable","type":"\u0004","is_mandatory":true,"title":"Whether the file is readable by its owner","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user_writeable":{"name":"user_writeable","type":"\u0004","is_mandatory":true,"title":"Whether the file is writeable by its owner","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Access permissions for a given file","private":true,"min_provider_version":"9.0.0","defaults":"string","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"id":"files","name":"files","fields":{"find":{"name":"find","type":"\u001bfiles.find","title":"File search results","desc":"Files discovered by a recursive filesystem walk rooted at `from`. Narrow the walk with `type` (file, directory, device, and so on), `regex` (path/name pattern), `permissions` (octal mode floor), `name` (filename glob), `depth` (maximum traversal depth), and `xdev` (whether to cross into other mounted filesystems). Resolves to the matching `[]file` list, so content, ownership, and permission checks can be layered on the result. For example `files.find(from: \"/etc\", type: \"file\", permissions: 0o002) { path }` finds every world-writable file under /etc.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"title":"File search and discovery namespace","desc":"Empty namespace whose only purpose is to host `files.find`, so audits can write `files.find(...) {...}` to locate files on the asset rather than enumerating known paths.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files.find":{"id":"files.find","name":"files.find","fields":{"depth":{"name":"depth","type":"\u0005","is_mandatory":true,"title":"Maximum directory depth to descend (find's -maxdepth); unset means unlimited","min_provider_version":"11.3.5","provider":"go.mondoo.com/cnquery/v9/providers/os"},"from":{"name":"from","type":"\u0007","is_mandatory":true,"title":"Directory the recursive search starts from (e.g., \"/etc\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bfile","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Filename glob matched against each file's basename (e.g., \"*.conf\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"permissions":{"name":"permissions","type":"\u0005","is_mandatory":true,"title":"Octal mode floor: matches files that have at least these permission bits set","desc":"Given as an octal literal (e.g., 0o002 for world-writable). Defaults to 0o777, which matches every file.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"regex":{"name":"regex","type":"\u0007","is_mandatory":true,"title":"Regular expression matched against the full path of each candidate","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Restrict results to a single file type","desc":"One of file, directory, link, character, block, or socket. Empty matches every type.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"xdev":{"name":"xdev","type":"\u0004","is_mandatory":true,"title":"Whether to descend into directories on other mounted filesystems","desc":"When false (the default) the search stays on the filesystem that holds `from` (find's -xdev). Set true to cross mount points.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bfile","title":"File search results","desc":"Files discovered by a recursive filesystem walk rooted at `from`. Narrow the walk with `type` (file, directory, device, and so on), `regex` (path/name pattern), `permissions` (octal mode floor), `name` (filename glob), `depth` (maximum traversal depth), and `xdev` (whether to cross into other mounted filesystems). Resolves to the matching `[]file` list, so content, ownership, and permission checks can be layered on the result. For example `files.find(from: \"/etc\", type: \"file\", permissions: 0o002) { path }` finds every world-writable file under /etc.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"firefox":{"id":"firefox","name":"firefox","fields":{"addon":{"name":"addon","type":"\u001bfirefox.addon","title":"Firefox browser addon","desc":"Single addon installed in a Firefox-family profile, parsed from the profile's extensions.json. Beyond `name`, `version`, and `type`, the record exposes enablement state (`active`, `userDisabled`, `disabled`), where it came from (`sourceUri`, `location`), whether auto-update is on (`autoupdate`), and the combined API `permissions` and host origins it was granted, so you can audit addon trust and overreach per user.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"addons":{"name":"addons","type":"\u0019\u001bfirefox.addon","title":"All installed Firefox addons across all profiles and users","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Firefox-family browsers","desc":"Installed browser addons discovered across every user account and profile for Firefox and its derivatives (Firefox Developer Edition, Nightly, LibreWolf, Waterfox, Floorp, Zen, Tor Browser, and Mullvad Browser). Iterate `addons` to inventory extensions and themes, spot disabled or side-loaded addons, and review the API permissions and host origins each addon requests. Mozilla-shipped system addons, locales, and dictionaries are filtered out.","min_provider_version":"11.4.86","provider":"go.mondoo.com/cnquery/v9/providers/os"},"firefox.addon":{"id":"firefox.addon","name":"firefox.addon","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the addon is currently active","provider":"go.mondoo.com/cnquery/v9/providers/os"},"autoupdate":{"name":"autoupdate","type":"\u0004","is_mandatory":true,"title":"Whether auto-updates are enabled for this addon (true when set to \"on\" or \"use global default\")","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"browser":{"name":"browser","type":"\u0007","is_mandatory":true,"title":"Browser name (e.g., \"Firefox\", \"Firefox Developer Edition\", \"LibreWolf\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"creator":{"name":"creator","type":"\u0007","is_mandatory":true,"title":"Addon creator/author name","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Addon description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disabled":{"name":"disabled","type":"\u0004","is_mandatory":true,"title":"Whether the addon is disabled (user or app disabled)","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"Unique addon identifier (e.g., \"{uuid}\" or \"addon@example.com\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installDate":{"name":"installDate","type":"\u0005","is_mandatory":true,"title":"Install date as Unix timestamp (milliseconds)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Install location (e.g., \"app-profile\", \"app-system-defaults\", \"app-builtin\")","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Addon name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"native":{"name":"native","type":"\u0004","is_mandatory":true,"title":"Whether this is a native WebExtension (no special loader)","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the addon (can be XPI file or directory)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"permissions":{"name":"permissions","type":"\u0019\u0007","is_mandatory":true,"title":"Combined API permissions and host origins","desc":"Merged list of the addon's requested WebExtension API permissions (e.g. \"tabs\", \"webRequest\") and host origin patterns (e.g. \"https://*/*\"). Broad host access is a useful audit signal.","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"profile":{"name":"profile","type":"\u0007","is_mandatory":true,"title":"Firefox profile where addon is installed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sourceUri":{"name":"sourceUri","type":"\u0007","is_mandatory":true,"title":"Source URI from where addon was installed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Addon type (extension, theme, locale, dictionary, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uid":{"name":"uid","type":"\u0005","is_mandatory":true,"title":"UID of the user who owns this addon","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"updateDate":{"name":"updateDate","type":"\u0005","is_mandatory":true,"title":"Last update date as Unix timestamp (milliseconds)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"userDisabled":{"name":"userDisabled","type":"\u0004","is_mandatory":true,"title":"Whether the addon is disabled by user","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Addon version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"visible":{"name":"visible","type":"\u0004","is_mandatory":true,"title":"Whether the addon is visible in the addon manager","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Firefox browser addon","desc":"Single addon installed in a Firefox-family profile, parsed from the profile's extensions.json. Beyond `name`, `version`, and `type`, the record exposes enablement state (`active`, `userDisabled`, `disabled`), where it came from (`sourceUri`, `location`), whether auto-update is on (`autoupdate`), and the combined API `permissions` and host origins it was granted, so you can audit addon trust and overreach per user.","private":true,"min_provider_version":"11.4.86","defaults":"name version active browser","provider":"go.mondoo.com/cnquery/v9/providers/os"},"firewalld":{"id":"firewalld","name":"firewalld","fields":{"defaultZone":{"name":"defaultZone","type":"\u0007","title":"Default zone name (e.g., \"public\", \"home\", \"dmz\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"richrule":{"name":"richrule","type":"\u001bfirewalld.richrule","title":"firewalld rich rule","desc":"Single firewalld rich rule parsed into its parts: the address family, the source and destination it matches (each with a negation flag for `NOT` address forms), and the action it takes. The full original rule text is kept in `rule`. Rich rules express finer-grained policy than plain service/port entries, so auditing `source`, `sourceInverted`, and `action` together shows exactly which peers are accepted, rejected, or dropped.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"status":{"name":"status","type":"\u0007","title":"Whether firewalld is running (\"running\", \"not running\", \"not installed\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"zone":{"name":"zone","type":"\u001bfirewalld.zone","title":"firewalld zone configuration","desc":"Single firewalld zone: the trust level applied to the interfaces and source addresses bound to it. The `target` is the default action for traffic not otherwise matched (default, ACCEPT, REJECT, or DROP), and `active` indicates whether any interfaces or sources are bound. Audit `services`, `ports`, and `protocols` for what the zone permits, `richRules` for expressive per-source rules, and `masquerade` / `forwardPorts` for NAT behavior. Select a zone by name with `firewalld.zone(name: \"public\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"zones":{"name":"zones","type":"\u0019\u001bfirewalld.zone","title":"All configured zones","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"firewalld dynamic firewall manager (RHEL/CentOS/Fedora)","desc":"firewalld daemon state, the default zone, and the full set of configured zones on RHEL, CentOS, and Fedora systems. Check `status` to confirm the daemon is running and `defaultZone` for the zone applied to unclassified interfaces and sources. Enumerate `zones` to audit the per-zone services, ports, and rich rules that make up the effective policy.","min_provider_version":"13.2.9","defaults":"status defaultZone","provider":"go.mondoo.com/cnquery/v9/providers/os"},"firewalld.richrule":{"id":"firewalld.richrule","name":"firewalld.richrule","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action (accept, reject, drop, mark), empty if not specified","provider":"go.mondoo.com/cnquery/v9/providers/os"},"destination":{"name":"destination","type":"\u0007","is_mandatory":true,"title":"Destination address/subnet, empty if not specified","provider":"go.mondoo.com/cnquery/v9/providers/os"},"destinationInverted":{"name":"destinationInverted","type":"\u0004","is_mandatory":true,"title":"True when the destination address is negated (e.g., `destination NOT address=\"...\"`)","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"Address family (\"ipv4\" or \"ipv6\"), empty if not specified","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rule":{"name":"rule","type":"\u0007","is_mandatory":true,"title":"Full rich rule string","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Source address/subnet, empty if not specified","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sourceInverted":{"name":"sourceInverted","type":"\u0004","is_mandatory":true,"title":"True when the source address is negated (e.g., `source NOT address=\"...\"`)","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"firewalld rich rule","desc":"Single firewalld rich rule parsed into its parts: the address family, the source and destination it matches (each with a negation flag for `NOT` address forms), and the action it takes. The full original rule text is kept in `rule`. Rich rules express finer-grained policy than plain service/port entries, so auditing `source`, `sourceInverted`, and `action` together shows exactly which peers are accepted, rejected, or dropped.","private":true,"min_provider_version":"13.2.9","defaults":"family rule","provider":"go.mondoo.com/cnquery/v9/providers/os"},"firewalld.zone":{"id":"firewalld.zone","name":"firewalld.zone","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether this zone is currently active (has bound interfaces or sources)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"forwardPorts":{"name":"forwardPorts","type":"\u0019\u0007","is_mandatory":true,"title":"Port forwarding rules (e.g., \"port=80:proto=tcp:toport=8080\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"icmpBlockInversion":{"name":"icmpBlockInversion","type":"\u0004","is_mandatory":true,"title":"Whether ICMP block inversion is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"icmpBlocks":{"name":"icmpBlocks","type":"\u0019\u0007","is_mandatory":true,"title":"ICMP types that are blocked","provider":"go.mondoo.com/cnquery/v9/providers/os"},"interfaces":{"name":"interfaces","type":"\u0019\u0007","is_mandatory":true,"title":"Network interfaces bound to this zone","provider":"go.mondoo.com/cnquery/v9/providers/os"},"masquerade":{"name":"masquerade","type":"\u0004","is_mandatory":true,"title":"Whether masquerading is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Zone name (e.g., \"public\", \"internal\", \"dmz\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ports":{"name":"ports","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed ports (e.g., \"80/tcp\", \"443/tcp\", \"8080-8090/udp\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"protocols":{"name":"protocols","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed protocols (e.g., \"icmp\", \"ipv6-icmp\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"richRules":{"name":"richRules","type":"\u0019\u001bfirewalld.richrule","is_mandatory":true,"title":"Rich rules (expressive firewall rules)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"services":{"name":"services","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed service names (e.g., \"ssh\", \"http\", \"https\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sourcePorts":{"name":"sourcePorts","type":"\u0019\u0007","is_mandatory":true,"title":"Source ports","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sources":{"name":"sources","type":"\u0019\u0007","is_mandatory":true,"title":"Source addresses/subnets bound to this zone","provider":"go.mondoo.com/cnquery/v9/providers/os"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"Default target (default, ACCEPT, REJECT, DROP)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007","optional":true}]},"title":"firewalld zone configuration","desc":"Single firewalld zone: the trust level applied to the interfaces and source addresses bound to it. The `target` is the default action for traffic not otherwise matched (default, ACCEPT, REJECT, or DROP), and `active` indicates whether any interfaces or sources are bound. Audit `services`, `ports`, and `protocols` for what the zone permits, `richRules` for expressive per-source rules, and `masquerade` / `forwardPorts` for NAT behavior. Select a zone by name with `firewalld.zone(name: \"public\")`.","private":true,"min_provider_version":"13.2.9","defaults":"name target","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fstab":{"id":"fstab","name":"fstab","fields":{"entries":{"name":"entries","type":"\u0019\u001bfstab.entry","title":"fstab entries defined in this fstab file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entry":{"name":"entry","type":"\u001bfstab.entry","title":"fstab entry for a device and its mount point","desc":"Single line of the fstab: the device to mount, where it mounts, its filesystem type, the comma-separated mount options, and the dump/fsck controls. The `options` field is the one audits most often assert on (for example requiring nosuid,nodev,noexec on /tmp or /var).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"path":{"name":"path","type":"\u0007","is_mandatory":true,"provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"fstab persistent mount table","desc":"Filesystem mount table (/etc/fstab) that defines which devices are mounted where at boot and with what options. Each `entries` row carries the device, mount point, filesystem type, and mount options, so audits can check for hardening flags (nodev, nosuid, noexec) on sensitive mounts. Select an alternate file with `fstab(path: \"...\")`.","min_provider_version":"11.3.5","defaults":"path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fstab.entry":{"id":"fstab.entry","name":"fstab.entry","fields":{"device":{"name":"device","type":"\u0007","is_mandatory":true,"title":"Device referenced in the fstab, e.g., LABEL=rootfs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dump":{"name":"dump","type":"\u0005","is_mandatory":true,"title":"Dump frequency (0 for full backup or an integer above 0, incremental backup, copies all files new or modified since the last dump of a lower level)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fsck":{"name":"fsck","type":"\u0005","is_mandatory":true,"title":"File system check order, e.g., 1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fstype":{"name":"fstype","type":"\u0007","is_mandatory":true,"title":"File system type, e.g., ext4","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mountpoint":{"name":"mountpoint","type":"\u0007","is_mandatory":true,"title":"Mount point, e.g., '/'","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0007","is_mandatory":true,"title":"Mount options, e.g., defaults (`man fstab` for details)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"fstab entry for a device and its mount point","desc":"Single line of the fstab: the device to mount, where it mounts, its filesystem type, the comma-separated mount options, and the dump/fsck controls. The `options` field is the one audits most often assert on (for example requiring nosuid,nodev,noexec on /tmp or /var).","private":true,"min_provider_version":"11.3.5","defaults":"device mountpoint","provider":"go.mondoo.com/cnquery/v9/providers/os"},"gemini":{"id":"gemini","name":"gemini","fields":{"authType":{"name":"authType","type":"\u0007","title":"Authentication type configured for the assistant","provider":"go.mondoo.com/cnquery/v9/providers/os"},"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Gemini configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mcpServer":{"name":"mcpServer","type":"\u001bgemini.mcpServer","title":"Gemini MCP server configuration","desc":"Model Context Protocol server Gemini is configured to use. The command and args launch the server to expose external tools and data to the assistant, and hasEnv reports whether environment variables (often holding API keys or tokens) are configured for it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"mcpServers":{"name":"mcpServers","type":"\u0019\u001bgemini.mcpServer","title":"MCP servers the tool connects to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional, null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"settings":{"name":"settings","type":"\n","title":"Full settings dictionary parsed from the Gemini configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bgemini.skill","title":"Gemini skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the assistant. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bgemini.skill","title":"Installed skills","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Gemini CLI (Google) instance","desc":"Google Gemini command-line tool installed on the host. Queryable through it are the authentication type, the settings dictionary, the configured MCP servers, and any installed skills, along with the package that installed the tool and the runtime it executes in. Useful for auditing how the assistant authenticates and what tools it can reach. URL: https://github.com/google-gemini/gemini-cli","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"gemini.mcpServer":{"id":"gemini.mcpServer","name":"gemini.mcpServer","fields":{"args":{"name":"args","type":"\u0019\u0007","is_mandatory":true,"title":"Command-line arguments passed to the server command","provider":"go.mondoo.com/cnquery/v9/providers/os"},"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Local command launched for the server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hasEnv":{"name":"hasEnv","type":"\u0004","is_mandatory":true,"title":"Whether environment variables (for example API keys) are configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Server name","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Gemini MCP server configuration","desc":"Model Context Protocol server Gemini is configured to use. The command and args launch the server to expose external tools and data to the assistant, and hasEnv reports whether environment variables (often holding API keys or tokens) are configured for it.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"gemini.skill":{"id":"gemini.skill","name":"gemini.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint describing the skill's expected arguments","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full markdown content of the skill definition","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content, for integrity checks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Gemini skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the assistant. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"github":{"id":"github","fields":{"copilot":{"name":"copilot","type":"\u001bgithub.copilot","title":"GitHub Copilot CLI instance","desc":"GitHub Copilot command-line tool installed on the host. Queryable through it are the authenticated GitHub accounts, the configured MCP servers, and any installed skills, along with the package that installed the tool and the runtime it executes in. Useful for auditing which identities and external tools the AI assistant can reach. URL: https://github.com/features/copilot","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"}},"is_extension":true},"github.copilot":{"id":"github.copilot","name":"github.copilot","fields":{"account":{"name":"account","type":"\u001bgithub.copilot.account","title":"GitHub Copilot authenticated account","desc":"GitHub account authenticated for use with Copilot on the host. The user field is the GitHub username and githubAppId identifies the GitHub App backing the session, useful for reviewing which identities have active Copilot access.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"accounts":{"name":"accounts","type":"\u0019\u001bgithub.copilot.account","title":"Authenticated GitHub accounts","provider":"go.mondoo.com/cnquery/v9/providers/os"},"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the GitHub Copilot configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mcpServer":{"name":"mcpServer","type":"\u001bgithub.copilot.mcpServer","title":"GitHub Copilot MCP server configuration","desc":"Model Context Protocol server Copilot is configured to use. Stdio-type servers launch a local command with the given args to expose external tools and data to the assistant.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"mcpServers":{"name":"mcpServers","type":"\u0019\u001bgithub.copilot.mcpServer","title":"MCP servers the tool connects to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional, null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bgithub.copilot.skill","title":"GitHub Copilot skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the assistant. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bgithub.copilot.skill","title":"Installed skills","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"GitHub Copilot CLI instance","desc":"GitHub Copilot command-line tool installed on the host. Queryable through it are the authenticated GitHub accounts, the configured MCP servers, and any installed skills, along with the package that installed the tool and the runtime it executes in. Useful for auditing which identities and external tools the AI assistant can reach. URL: https://github.com/features/copilot","min_provider_version":"13.12.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"github.copilot.account":{"id":"github.copilot.account","name":"github.copilot.account","fields":{"githubAppId":{"name":"githubAppId","type":"\u0007","is_mandatory":true,"title":"GitHub App ID backing the authenticated session","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"GitHub username","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"GitHub Copilot authenticated account","desc":"GitHub account authenticated for use with Copilot on the host. The user field is the GitHub username and githubAppId identifies the GitHub App backing the session, useful for reviewing which identities have active Copilot access.","private":true,"min_provider_version":"13.12.1","defaults":"user","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"github.copilot.mcpServer":{"id":"github.copilot.mcpServer","name":"github.copilot.mcpServer","fields":{"args":{"name":"args","type":"\u0019\u0007","is_mandatory":true,"title":"Command-line arguments passed to the server command","provider":"go.mondoo.com/cnquery/v9/providers/os"},"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Local command launched for the server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Server name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Server transport type, for example \"stdio\"","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"GitHub Copilot MCP server configuration","desc":"Model Context Protocol server Copilot is configured to use. Stdio-type servers launch a local command with the given args to expose external tools and data to the assistant.","private":true,"min_provider_version":"13.12.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"github.copilot.skill":{"id":"github.copilot.skill","name":"github.copilot.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint describing the skill's expected arguments","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full markdown content of the skill definition","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content, for integrity checks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"GitHub Copilot skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the assistant. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","private":true,"min_provider_version":"13.12.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"githubactions":{"id":"githubactions","fields":{"package":{"name":"package","type":"\u001bgithubactions.package","title":"GitHub Actions action reference","desc":"Single GitHub Actions action referenced in a workflow, exposing its unique `id`, `name` in `owner/repo` or `owner/repo/path` form, the pinned `version` (a tag, branch, or commit SHA), `purl` identifier, and the workflow files that reference it. Pinning to a commit SHA rather than a mutable tag is a common supply-chain hardening check.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bgithubactions.packages","title":"GitHub Actions workflow dependencies","desc":"Action references (owner/repo@version) pinned across the workflow YAML files in a repository. Useful for auditing which third-party actions and versions a CI pipeline trusts. Set `path` to a workflows directory or a specific .yml file.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"githubactions.package":{"id":"githubactions.package","name":"githubactions.package","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Workflow files that reference this action","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the action within the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Name of the action in owner/repo or owner/repo/path form","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl), a standardized identifier for the action","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Pinned version: a tag, branch, or commit SHA","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"GitHub Actions action reference","desc":"Single GitHub Actions action referenced in a workflow, exposing its unique `id`, `name` in `owner/repo` or `owner/repo/path` form, the pinned `version` (a tag, branch, or commit SHA), `purl` identifier, and the workflow files that reference it. Pinning to a commit SHA rather than a mutable tag is a common supply-chain hardening check.","min_provider_version":"13.10.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"githubactions.packages":{"id":"githubactions.packages","name":"githubactions.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bgithubactions.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for workflow files (directory or specific .yml file)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bgithubactions.package","title":"GitHub Actions workflow dependencies","desc":"Action references (owner/repo@version) pinned across the workflow YAML files in a repository. Useful for auditing which third-party actions and versions a CI pipeline trusts. Set `path` to a workflows directory or a specific .yml file.","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"go":{"id":"go","fields":{"package":{"name":"package","type":"\u001bgo.package","title":"Go module dependency","desc":"A single Go module: its unique `id`, module path as `name`, `version`, `purl`, CPEs, and the files that contributed it. Iterated from `go.packages` for the full tree or from `directDependencies` for direct dependencies only.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bgo.packages","title":"Go module inventory","desc":"Go modules discovered under a path: the `root` module, the `directDependencies`, and the full transitive tree (iterated from the list itself). Parsed from module metadata such as `go.mod`. Pass `path` to point at a specific project.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"go.package":{"id":"go.package","name":"go.package","fields":{"cpes":{"name":"cpes","type":"\u0019\u001bcpe","title":"Common Platform Enumeration (CPE) for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Package files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID is the go.package unique identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Name of the module (module path)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Version of the module","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Go module dependency","desc":"A single Go module: its unique `id`, module path as `name`, `version`, `purl`, CPEs, and the files that contributed it. Iterated from `go.packages` for the full tree or from `directDependencies` for direct dependencies only.","min_provider_version":"13.10.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"go.packages":{"id":"go.packages","name":"go.packages","fields":{"directDependencies":{"name":"directDependencies","type":"\u0019\u001bgo.package","title":"List of direct dependencies","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bgo.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for Go module files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"root":{"name":"root","type":"\u001bgo.package","title":"Root module (may not exist)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bgo.package","title":"Go module inventory","desc":"Go modules discovered under a path: the `root` module, the `directDependencies`, and the full transitive tree (iterated from the list itself). Parsed from module metadata such as `go.mod`. Pass `path` to point at a specific project.","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"goose":{"id":"goose","name":"goose","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Goose configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"extension":{"name":"extension","type":"\u001bgoose.extension","title":"Goose extension","desc":"Extension configured for the Goose agent, adding tools or integrations. The type distinguishes a \"platform\" extension (external process) from a \"builtin\" one, bundled reports whether it ships with Goose, enabled reports whether it is active, and timeout is its execution limit in seconds (0 means no timeout).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"extensions":{"name":"extensions","type":"\u0019\u001bgoose.extension","title":"Configured extensions","provider":"go.mondoo.com/cnquery/v9/providers/os"},"model":{"name":"model","type":"\u0007","title":"Active model name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"provider":{"name":"provider","type":"\u0007","title":"Active AI provider name (the configured model backend)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional, null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bgoose.skill","title":"Goose skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the agent. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bgoose.skill","title":"Installed skills","provider":"go.mondoo.com/cnquery/v9/providers/os"},"telemetryEnabled":{"name":"telemetryEnabled","type":"\u0004","title":"Whether usage telemetry is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Goose AI agent (Block) instance","desc":"Goose AI agent from Block installed on the host. Queryable through it are the active provider and model, whether telemetry is enabled, the configured extensions, and any installed skills, along with the package that installed the agent and the runtime it executes in. Useful for auditing which model backend and extensions the agent uses. URL: https://block.github.io/goose/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"goose.extension":{"id":"goose.extension","name":"goose.extension","fields":{"bundled":{"name":"bundled","type":"\u0004","is_mandatory":true,"title":"Whether the extension ships bundled with Goose","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Extension description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the extension is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Extension name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"timeout":{"name":"timeout","type":"\u0005","is_mandatory":true,"title":"Extension execution timeout in seconds (0 means no timeout)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Extension type: \"platform\" or \"builtin\"","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Goose extension","desc":"Extension configured for the Goose agent, adding tools or integrations. The type distinguishes a \"platform\" extension (external process) from a \"builtin\" one, bundled reports whether it ships with Goose, enabled reports whether it is active, and timeout is its execution limit in seconds (0 means no timeout).","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"goose.skill":{"id":"goose.skill","name":"goose.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint describing the skill's expected arguments","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full markdown content of the skill definition","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content, for integrity checks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Goose skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the agent. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"group":{"id":"group","name":"group","fields":{"gid":{"name":"gid","type":"\u0005","is_mandatory":true,"title":"Group ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"members":{"name":"members","type":"\u0019\u001buser","title":"Users who are members of this group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of this group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sid":{"name":"sid","type":"\u0007","is_mandatory":true,"title":"Group's security identifier (Windows)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"id","type":"\u0007"}]},"title":"Group on the system","desc":"Single local group: numeric GID (or SID on Windows), group name, and the `members` list of users in the group. Used to audit privileged-group membership (`sudo`, `wheel`, `docker`, `adm`, and so on) and to confirm only expected accounts are present.","min_provider_version":"9.0.0","defaults":"name gid","provider":"go.mondoo.com/cnquery/v9/providers/os"},"groups":{"id":"groups","name":"groups","fields":{"list":{"name":"list","type":"\u0019\u001bgroup","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bgroup","title":"All groups configured on the system","desc":"Collection of every local `group`. The entry point for fleet-wide group-membership audits (every member of a privileged group, no two groups sharing a GID, no human user in `wheel` outside an approved list, and so on).","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"grub":{"id":"grub","fields":{"config":{"name":"config","type":"\u001bgrub.config","title":"GRUB bootloader configuration","desc":"GRUB bootloader settings drawn from /etc/default/grub and the generated grub.cfg. The `params` map holds the key-value defaults (for example GRUB_TIMEOUT and GRUB_CMDLINE_LINUX), `entries` lists the boot menu entries with their kernel command lines, and `passwordProtected` reports whether superuser plus password_pbkdf2 protection is configured, a common boot-security check. Override the file locations with `grub.config(defaultsPath: \"...\", grubPath: \"...\")`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"grub.config":{"id":"grub.config","name":"grub.config","fields":{"defaultsPath":{"name":"defaultsPath","type":"\u0007","is_mandatory":true,"title":"Path to /etc/default/grub (key-value defaults)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entries":{"name":"entries","type":"\u0019\u001bgrub.config.entry","title":"Menu entries defined in grub.cfg","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entry":{"name":"entry","type":"\u001bgrub.config.entry","title":"GRUB menu entry","desc":"Single boot menu entry from grub.cfg: its title, the kernel command line it boots with (`cmdline`), and the initrd it loads. Inspect `cmdline` to audit kernel boot parameters such as audit=1 or console settings. `isSubmenu` marks entries that group other entries rather than boot directly.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"grubPath":{"name":"grubPath","type":"\u0007","is_mandatory":true,"title":"Path to grub.cfg (generated configuration)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","title":"Configuration parameters from /etc/default/grub (e.g., GRUB_TIMEOUT, GRUB_CMDLINE_LINUX)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"passwordProtected":{"name":"passwordProtected","type":"\u0004","title":"Whether GRUB password protection is enabled (superusers + password_pbkdf2)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"defaultsPath","type":"\u0007","optional":true},{"name":"grubPath","type":"\u0007","optional":true}]},"title":"GRUB bootloader configuration","desc":"GRUB bootloader settings drawn from /etc/default/grub and the generated grub.cfg. The `params` map holds the key-value defaults (for example GRUB_TIMEOUT and GRUB_CMDLINE_LINUX), `entries` lists the boot menu entries with their kernel command lines, and `passwordProtected` reports whether superuser plus password_pbkdf2 protection is configured, a common boot-security check. Override the file locations with `grub.config(defaultsPath: \"...\", grubPath: \"...\")`.","min_provider_version":"13.2.7","defaults":"defaultsPath grubPath","provider":"go.mondoo.com/cnquery/v9/providers/os"},"grub.config.entry":{"id":"grub.config.entry","name":"grub.config.entry","fields":{"cmdline":{"name":"cmdline","type":"\u0007","is_mandatory":true,"title":"Kernel command line (linux/linux16/linuxefi line)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"initrd":{"name":"initrd","type":"\u0007","is_mandatory":true,"title":"Initrd path (initrd/initrd16/initrdefi line)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isSubmenu":{"name":"isSubmenu","type":"\u0004","is_mandatory":true,"title":"Whether this is a submenu","provider":"go.mondoo.com/cnquery/v9/providers/os"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Menu entry title","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"GRUB menu entry","desc":"Single boot menu entry from grub.cfg: its title, the kernel command line it boots with (`cmdline`), and the initrd it loads. Inspect `cmdline` to audit kernel boot parameters such as audit=1 or console settings. `isSubmenu` marks entries that group other entries rather than boot directly.","private":true,"min_provider_version":"13.2.7","defaults":"title","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy":{"id":"haproxy","name":"haproxy","fields":{"config":{"name":"config","type":"\u001bhaproxy.config","title":"HAProxy configuration","desc":"Parsed haproxy.cfg, any `\u003cconfigdir\u003e/conf.d/*.cfg` fragments next to it, and every file pulled in by `!include` / `!includeglob` directives (HAProxy 2.4+). Exposes each section as a dedicated resource, plus a raw view over every section for types that are not modeled. Pass `init(path: \"...\")` to point at a non-default config file.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"version":{"name":"version","type":"\u0007","title":"HAProxy version string extracted from the haproxy binary (e.g., \"2.8.4-1\")","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"HAProxy load balancer","desc":"HAProxy daemon version and configuration. The configuration covers the global section, defaults blocks, frontends, backends, listens, the servers behind each backend, and supporting sections (resolvers, userlists, peers).","min_provider_version":"13.19.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy.config":{"id":"haproxy.config","name":"haproxy.config","fields":{"backend":{"name":"backend","type":"\u001bhaproxy.config.backend","title":"HAProxy backend section","desc":"Backend server pool. Exposes the load-balancing algorithm, the servers behind it, their TLS posture (ssl/verify/ca-file) and health-check configuration (`option httpchk`/`http-check`), `default-server` defaults, stick-table/cookie persistence, request mutators, and timeouts. Useful for verifying that backend connections are encrypted and health-checked.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"backends":{"name":"backends","type":"\u0019\u001bhaproxy.config.backend","refs":["\"file\""],"title":"Backend sections","provider":"go.mondoo.com/cnquery/v9/providers/os"},"bind":{"name":"bind","type":"\u001bhaproxy.config.bind","title":"HAProxy bind listener","desc":"Single listener address produced by a `bind` directive. A `bind a:1,b:2 ssl crt foo` directive expands into one of these per address form; the shared parameters (ssl, crt, alpn, verify, etc.) are copied onto each entry. Fields expose the listen address/port and the full TLS posture, so you can assert that exposed listeners require modern TLS and client verification.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"defaults":{"name":"defaults","type":"\u0019\u001bhaproxy.config.defaultsSection","refs":["\"file\""],"title":"Defaults sections: one unnamed block in classic configs, possibly several named blocks in HAProxy 2.4+","provider":"go.mondoo.com/cnquery/v9/providers/os"},"defaultsSection":{"name":"defaultsSection","type":"\u001bhaproxy.config.defaultsSection","title":"HAProxy defaults section","desc":"Inherited defaults applied to every frontend, backend, and listen that doesn't override a setting locally. HAProxy 2.4+ supports multiple named defaults blocks; `name` selects which one.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"file":{"name":"file","type":"\u001bfile","title":"Primary configuration file (defaults to /etc/haproxy/haproxy.cfg)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bfile","refs":["\"file\""],"title":"All configuration files visited (root + conf.d/*.cfg fragments + !included files)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"frontend":{"name":"frontend","type":"\u001bhaproxy.config.frontend","title":"HAProxy frontend section","desc":"Inbound traffic acceptor. Exposes its `bind` listeners (with TLS settings), ACL definitions, request routing rules, the default backend, and the timeout/log/option set applied to client traffic. Useful for auditing which addresses and ports are exposed and whether TLS is enforced on them.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"frontends":{"name":"frontends","type":"\u0019\u001bhaproxy.config.frontend","refs":["\"file\""],"title":"Frontend sections","provider":"go.mondoo.com/cnquery/v9/providers/os"},"global":{"name":"global","type":"\u001bhaproxy.config.global","refs":["\"file\""],"title":"Global section","provider":"go.mondoo.com/cnquery/v9/providers/os"},"listen":{"name":"listen","type":"\u001bhaproxy.config.listen","title":"HAProxy listen section","desc":"Combined frontend and backend section. Exposes the same audit surface as a backend (servers, balance, health checks) plus the frontend's `bind` listeners and ACL/routing surface, for the shorthand where a single section both accepts client traffic and defines its server pool.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"listens":{"name":"listens","type":"\u0019\u001bhaproxy.config.listen","refs":["\"file\""],"title":"Listen sections (combined frontend + backend)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"peers":{"name":"peers","type":"\u0019\u001bhaproxy.config.peersSection","refs":["\"file\""],"title":"Peers sections (stick-table replication)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"peersSection":{"name":"peersSection","type":"\u001bhaproxy.config.peersSection","title":"HAProxy peers section","desc":"Peers section used for stick-table replication between HAProxy instances. Exposes the peer servers and the replicated stick-table definitions.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"resolvers":{"name":"resolvers","type":"\u0019\u001bhaproxy.config.resolversSection","refs":["\"file\""],"title":"Resolvers sections (DNS resolver pools)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"resolversSection":{"name":"resolversSection","type":"\u001bhaproxy.config.resolversSection","title":"HAProxy resolvers section","desc":"DNS resolver pool used by `server` directives that resolve hostnames at runtime via `resolvers \u003cname\u003e`. Exposes the configured nameservers, retry/timeout tuning, and caching (`hold`) policy.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"section":{"name":"section","type":"\u001bhaproxy.config.section","title":"HAProxy configuration section (raw view)","desc":"Arbitrary section addressed by type and name. Useful for sections not modeled as their own resources (mailers, cache, program, ring, http-errors, fcgi-app, crt-store) and for low-level audits that need every directive in source order.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"sections":{"name":"sections","type":"\u0019\u001bhaproxy.config.section","refs":["\"file\""],"title":"Every parsed section in source order, including types not exposed as dedicated resources","provider":"go.mondoo.com/cnquery/v9/providers/os"},"server":{"name":"server","type":"\u001bhaproxy.config.server","title":"HAProxy backend server","desc":"Single member of a backend server pool. Captures the server identity (name/address/port), TLS posture toward the backend (ssl, verify, ca-file, sni, alpn), the health check tuning (inter/rise/fall/observe), connection limits, and persistence hooks. Useful for confirming that upstream connections are encrypted, verified, and actively health-checked.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"userlist":{"name":"userlist","type":"\u001bhaproxy.config.userlist","title":"HAProxy userlist section","desc":"HTTP-auth userlist consumed by `http-request auth` / `http-request deny unless { http_auth(\u003clist\u003e) }`. Captures users (with a flag indicating whether the password is hashed) and groups, so you can audit for cleartext (`insecure-password`) credentials.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"userlists":{"name":"userlists","type":"\u0019\u001bhaproxy.config.userlist","refs":["\"file\""],"title":"Userlist sections (HTTP auth groups/users)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"HAProxy configuration","desc":"Parsed haproxy.cfg, any `\u003cconfigdir\u003e/conf.d/*.cfg` fragments next to it, and every file pulled in by `!include` / `!includeglob` directives (HAProxy 2.4+). Exposes each section as a dedicated resource, plus a raw view over every section for types that are not modeled. Pass `init(path: \"...\")` to point at a non-default config file.","min_provider_version":"13.19.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy.config.backend":{"id":"haproxy.config.backend","name":"haproxy.config.backend","fields":{"acls":{"name":"acls","type":"\u0019\n","is_mandatory":true,"title":"`acl` definitions","provider":"go.mondoo.com/cnquery/v9/providers/os"},"balance":{"name":"balance","type":"\u0007","is_mandatory":true,"title":"`balance` algorithm (roundrobin, leastconn, source, uri, url_param, hdr, random, ...)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cookie":{"name":"cookie","type":"\u0007","is_mandatory":true,"title":"`cookie` directive arguments (name + flags)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"defaultServer":{"name":"defaultServer","type":"\n","is_mandatory":true,"title":"`default-server` directive parsed as a flag bag (same shape as a server, minus name/address)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disabledOptions":{"name":"disabledOptions","type":"\u0019\u0007","is_mandatory":true,"title":"`no option \u003cname\u003e` directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"Source file path where this backend is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hashType":{"name":"hashType","type":"\u0007","is_mandatory":true,"title":"`hash-type` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpCheck":{"name":"httpCheck","type":"\n","is_mandatory":true,"title":"Consolidated HTTP health check. Keys: {method, uri, version, send[], expect[], disabled}","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpRequestRules":{"name":"httpRequestRules","type":"\u0019\u0007","is_mandatory":true,"title":"`http-request \u003crule\u003e` lines","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpResponseRules":{"name":"httpResponseRules","type":"\u0019\u0007","is_mandatory":true,"title":"`http-response \u003crule\u003e` lines","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inherits":{"name":"inherits","type":"\u0007","is_mandatory":true,"title":"`from \u003cdefaults\u003e` argument when present","provider":"go.mondoo.com/cnquery/v9/providers/os"},"log":{"name":"log","type":"\u0019\u0007","is_mandatory":true,"title":"`log` directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"`mode` value (tcp, http)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Backend name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"`option \u003cname\u003e [args]` directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this backend, keyed by directive name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"retries":{"name":"retries","type":"\u0005","is_mandatory":true,"title":"`retries` value (defaults inherited; 0 means unset locally)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"servers":{"name":"servers","type":"\u0019\u001bhaproxy.config.server","is_mandatory":true,"title":"Servers behind this backend","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"`source` directive arguments (e.g., \"0.0.0.0 usesrc clientip\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stickOn":{"name":"stickOn","type":"\u0007","is_mandatory":true,"title":"`stick on` value (raw expression)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stickTable":{"name":"stickTable","type":"\u0007","is_mandatory":true,"title":"`stick-table` arguments (raw string)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tcpRequestRules":{"name":"tcpRequestRules","type":"\u0019\u0007","is_mandatory":true,"title":"`tcp-request \u003crule\u003e` lines","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tcpResponseRules":{"name":"tcpResponseRules","type":"\u0019\u0007","is_mandatory":true,"title":"`tcp-response \u003crule\u003e` lines","provider":"go.mondoo.com/cnquery/v9/providers/os"},"timeouts":{"name":"timeouts","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"`timeout \u003ckind\u003e \u003cvalue\u003e` map keyed by kind (e.g., server, connect, check)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"HAProxy backend section","desc":"Backend server pool. Exposes the load-balancing algorithm, the servers behind it, their TLS posture (ssl/verify/ca-file) and health-check configuration (`option httpchk`/`http-check`), `default-server` defaults, stick-table/cookie persistence, request mutators, and timeouts. Useful for verifying that backend connections are encrypted and health-checked.","private":true,"min_provider_version":"13.19.1","defaults":"name mode balance","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy.config.bind":{"id":"haproxy.config.bind","name":"haproxy.config.bind","fields":{"acceptProxy":{"name":"acceptProxy","type":"\u0004","is_mandatory":true,"title":"Whether the `accept-proxy` flag requires a PROXY protocol header from the client","provider":"go.mondoo.com/cnquery/v9/providers/os"},"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Address part: \"*\" for the wildcard, an IP literal, \"[::]\" for IPv6, \"unix:/path\" / \"unix@...\" / \"abns@...\" for unix sockets, or a hostname","provider":"go.mondoo.com/cnquery/v9/providers/os"},"alpn":{"name":"alpn","type":"\u0007","is_mandatory":true,"title":"`alpn` argument (comma-separated protocols; e.g., \"h2,http/1.1\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"caFile":{"name":"caFile","type":"\u0007","is_mandatory":true,"title":"`ca-file` argument (CA bundle for client cert verification)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ciphers":{"name":"ciphers","type":"\u0007","is_mandatory":true,"title":"`ciphers` argument (TLS 1.0-1.2 cipher list)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ciphersuites":{"name":"ciphersuites","type":"\u0007","is_mandatory":true,"title":"`ciphersuites` argument (TLS 1.3 cipher suite list)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"crt":{"name":"crt","type":"\u0007","is_mandatory":true,"title":"`crt` argument (certificate path or directory)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"crtList":{"name":"crtList","type":"\u0007","is_mandatory":true,"title":"`crt-list` argument (path to a crt-list file)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"curves":{"name":"curves","type":"\u0007","is_mandatory":true,"title":"`curves` argument (named curve list)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"noSslv3":{"name":"noSslv3","type":"\u0004","is_mandatory":true,"title":"Whether the `no-sslv3` flag disables SSLv3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"noTlsv10":{"name":"noTlsv10","type":"\u0004","is_mandatory":true,"title":"Whether the `no-tlsv10` flag disables TLS 1.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"noTlsv11":{"name":"noTlsv11","type":"\u0004","is_mandatory":true,"title":"Whether the `no-tlsv11` flag disables TLS 1.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"noTlsv12":{"name":"noTlsv12","type":"\u0004","is_mandatory":true,"title":"Whether the `no-tlsv12` flag disables TLS 1.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"noTlsv13":{"name":"noTlsv13","type":"\u0004","is_mandatory":true,"title":"Whether the `no-tlsv13` flag disables TLS 1.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All key=value attributes on this bind line (catch-all including ones not surfaced as dedicated fields)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"TCP port for a single-port bind; 0 for unix sockets or port ranges","provider":"go.mondoo.com/cnquery/v9/providers/os"},"portRangeEnd":{"name":"portRangeEnd","type":"\u0005","is_mandatory":true,"title":"End of a port range; 0 if not a range","provider":"go.mondoo.com/cnquery/v9/providers/os"},"portRangeStart":{"name":"portRangeStart","type":"\u0005","is_mandatory":true,"title":"Start of a port range (e.g., `bind *:80-89`); 0 if not a range","provider":"go.mondoo.com/cnquery/v9/providers/os"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Raw argument string after the `bind` keyword","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ssl":{"name":"ssl","type":"\u0004","is_mandatory":true,"title":"Whether the `ssl` flag is present (TLS termination on this listener)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslMaxVer":{"name":"sslMaxVer","type":"\u0007","is_mandatory":true,"title":"`ssl-max-ver` argument","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslMinVer":{"name":"sslMinVer","type":"\u0007","is_mandatory":true,"title":"`ssl-min-ver` argument (e.g., \"TLSv1.2\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"transparent":{"name":"transparent","type":"\u0004","is_mandatory":true,"title":"Whether the `transparent` flag is set (bind to non-local addresses)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"v4v6":{"name":"v4v6","type":"\u0004","is_mandatory":true,"title":"`v4v6` flag (bind on both IPv4 and IPv6 when the socket supports it)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"v6only":{"name":"v6only","type":"\u0004","is_mandatory":true,"title":"Whether the `v6only` flag restricts the socket to IPv6","provider":"go.mondoo.com/cnquery/v9/providers/os"},"verify":{"name":"verify","type":"\u0007","is_mandatory":true,"title":"`verify` argument (none, optional, required)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"HAProxy bind listener","desc":"Single listener address produced by a `bind` directive. A `bind a:1,b:2 ssl crt foo` directive expands into one of these per address form; the shared parameters (ssl, crt, alpn, verify, etc.) are copied onto each entry. Fields expose the listen address/port and the full TLS posture, so you can assert that exposed listeners require modern TLS and client verification.","private":true,"min_provider_version":"13.19.1","defaults":"address port ssl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy.config.defaultsSection":{"id":"haproxy.config.defaultsSection","name":"haproxy.config.defaultsSection","fields":{"balance":{"name":"balance","type":"\u0007","is_mandatory":true,"title":"`balance` algorithm value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disabledOptions":{"name":"disabledOptions","type":"\u0019\u0007","is_mandatory":true,"title":"`no option \u003cname\u003e` directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"Source file path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inherits":{"name":"inherits","type":"\u0007","is_mandatory":true,"title":"`from \u003cother-defaults\u003e` argument when present","provider":"go.mondoo.com/cnquery/v9/providers/os"},"log":{"name":"log","type":"\u0019\u0007","is_mandatory":true,"title":"`log` directives, one entry per line","provider":"go.mondoo.com/cnquery/v9/providers/os"},"maxconn":{"name":"maxconn","type":"\u0005","is_mandatory":true,"title":"`maxconn` value (per-frontend limit when inherited)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"`mode` value (tcp, http)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Defaults section name (empty for the classic unnamed defaults block)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"`option \u003cname\u003e [args]` directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this defaults section","provider":"go.mondoo.com/cnquery/v9/providers/os"},"retries":{"name":"retries","type":"\u0005","is_mandatory":true,"title":"`retries` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"timeouts":{"name":"timeouts","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"`timeout \u003ckind\u003e \u003cvalue\u003e` map keyed by kind (connect, client, server, http-request, queue, tunnel, ...)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"HAProxy defaults section","desc":"Inherited defaults applied to every frontend, backend, and listen that doesn't override a setting locally. HAProxy 2.4+ supports multiple named defaults blocks; `name` selects which one.","private":true,"min_provider_version":"13.19.1","defaults":"name mode","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy.config.frontend":{"id":"haproxy.config.frontend","name":"haproxy.config.frontend","fields":{"acls":{"name":"acls","type":"\u0019\n","is_mandatory":true,"title":"`acl` definitions. Entries: {name, criterion, args, line, raw}","provider":"go.mondoo.com/cnquery/v9/providers/os"},"binds":{"name":"binds","type":"\u0019\u001bhaproxy.config.bind","is_mandatory":true,"title":"`bind` directives, broken out per address form (a comma-separated address list produces one entry per address)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"captures":{"name":"captures","type":"\u0019\u0007","is_mandatory":true,"title":"`capture` lines (raw arg strings)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"defaultBackend":{"name":"defaultBackend","type":"\u0007","is_mandatory":true,"title":"`default_backend` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disabledOptions":{"name":"disabledOptions","type":"\u0019\u0007","is_mandatory":true,"title":"`no option \u003cname\u003e` directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"Source file path where this frontend is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpRequestRules":{"name":"httpRequestRules","type":"\u0019\u0007","is_mandatory":true,"title":"`http-request \u003crule\u003e` lines (raw arg strings, in source order)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpResponseRules":{"name":"httpResponseRules","type":"\u0019\u0007","is_mandatory":true,"title":"`http-response \u003crule\u003e` lines","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inherits":{"name":"inherits","type":"\u0007","is_mandatory":true,"title":"`from \u003cdefaults\u003e` argument when present","provider":"go.mondoo.com/cnquery/v9/providers/os"},"log":{"name":"log","type":"\u0019\u0007","is_mandatory":true,"title":"`log` directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"maxconn":{"name":"maxconn","type":"\u0005","is_mandatory":true,"title":"`maxconn` value (per-frontend concurrent connection limit)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"`mode` value (tcp, http)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"monitorFail":{"name":"monitorFail","type":"\u0007","is_mandatory":true,"title":"`monitor fail` condition (everything after `monitor fail`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"monitorUri":{"name":"monitorUri","type":"\u0007","is_mandatory":true,"title":"`monitor-uri` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Frontend name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"`option \u003cname\u003e [args]` directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this frontend, keyed by directive name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"redirects":{"name":"redirects","type":"\u0019\u0007","is_mandatory":true,"title":"`redirect` lines","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tcpRequestRules":{"name":"tcpRequestRules","type":"\u0019\u0007","is_mandatory":true,"title":"`tcp-request \u003crule\u003e` lines","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tcpResponseRules":{"name":"tcpResponseRules","type":"\u0019\u0007","is_mandatory":true,"title":"`tcp-response \u003crule\u003e` lines","provider":"go.mondoo.com/cnquery/v9/providers/os"},"timeouts":{"name":"timeouts","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"`timeout \u003ckind\u003e \u003cvalue\u003e` map keyed by kind (e.g., client, connect)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"useBackends":{"name":"useBackends","type":"\u0019\n","is_mandatory":true,"title":"`use_backend` rules. Entries: {backend, condition, line, raw}","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"HAProxy frontend section","desc":"Inbound traffic acceptor. Exposes its `bind` listeners (with TLS settings), ACL definitions, request routing rules, the default backend, and the timeout/log/option set applied to client traffic. Useful for auditing which addresses and ports are exposed and whether TLS is enforced on them.","private":true,"min_provider_version":"13.19.1","defaults":"name mode","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy.config.global":{"id":"haproxy.config.global","name":"haproxy.config.global","fields":{"caBase":{"name":"caBase","type":"\u0007","is_mandatory":true,"title":"`ca-base` value (base directory for `ca-file` relative paths)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chroot":{"name":"chroot","type":"\u0007","is_mandatory":true,"title":"`chroot` directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"crtBase":{"name":"crtBase","type":"\u0007","is_mandatory":true,"title":"`crt-base` value (base directory for `crt` relative paths)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"daemon":{"name":"daemon","type":"\u0004","is_mandatory":true,"title":"`daemon` directive present","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disabledOptions":{"name":"disabledOptions","type":"\u0019\u0007","is_mandatory":true,"title":"Every `no option \u003cname\u003e` disabled in this section","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"Source file path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"`group` directive value (UNIX gid)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hardStopAfter":{"name":"hardStopAfter","type":"\u0007","is_mandatory":true,"title":"`hard-stop-after` value (time string, e.g. \"30s\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"log":{"name":"log","type":"\u0019\u0007","is_mandatory":true,"title":"`log` directives, one entry per line (e.g. \"/dev/log local0\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"masterWorker":{"name":"masterWorker","type":"\u0004","is_mandatory":true,"title":"`master-worker` directive present","provider":"go.mondoo.com/cnquery/v9/providers/os"},"maxconn":{"name":"maxconn","type":"\u0005","is_mandatory":true,"title":"`maxconn` value (global connection limit)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nbproc":{"name":"nbproc","type":"\u0005","is_mandatory":true,"title":"`nbproc` value (legacy; replaced by nbthread in HAProxy 2.5+)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nbthread":{"name":"nbthread","type":"\u0005","is_mandatory":true,"title":"`nbthread` value (worker threads per process)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"Every `option \u003cname\u003e [args]` enabled in this section","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this section (name -\u003e joined args, comma-concatenated when repeated)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pidfile":{"name":"pidfile","type":"\u0007","is_mandatory":true,"title":"`pidfile` path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslDefaultBindCiphers":{"name":"sslDefaultBindCiphers","type":"\u0007","is_mandatory":true,"title":"`ssl-default-bind-ciphers` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslDefaultBindCiphersuites":{"name":"sslDefaultBindCiphersuites","type":"\u0007","is_mandatory":true,"title":"`ssl-default-bind-ciphersuites` value (TLS 1.3 cipher list)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslDefaultBindCurves":{"name":"sslDefaultBindCurves","type":"\u0007","is_mandatory":true,"title":"`ssl-default-bind-curves` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslDefaultBindOptions":{"name":"sslDefaultBindOptions","type":"\u0007","is_mandatory":true,"title":"`ssl-default-bind-options` value (e.g., \"ssl-min-ver TLSv1.2 no-tls-tickets\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslDefaultServerCiphers":{"name":"sslDefaultServerCiphers","type":"\u0007","is_mandatory":true,"title":"`ssl-default-server-ciphers` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslDefaultServerCiphersuites":{"name":"sslDefaultServerCiphersuites","type":"\u0007","is_mandatory":true,"title":"`ssl-default-server-ciphersuites` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslDefaultServerCurves":{"name":"sslDefaultServerCurves","type":"\u0007","is_mandatory":true,"title":"`ssl-default-server-curves` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslDefaultServerOptions":{"name":"sslDefaultServerOptions","type":"\u0007","is_mandatory":true,"title":"`ssl-default-server-options` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"statsSocket":{"name":"statsSocket","type":"\u0007","is_mandatory":true,"title":"`stats socket` path (UNIX path or address)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"statsSocketLevel":{"name":"statsSocketLevel","type":"\u0007","is_mandatory":true,"title":"`level` arg on the stats socket line (user, operator, admin)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"statsSocketMode":{"name":"statsSocketMode","type":"\u0007","is_mandatory":true,"title":"`mode` arg on the stats socket line (octal as string)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"statsSocketUser":{"name":"statsSocketUser","type":"\u0007","is_mandatory":true,"title":"`user`/`group` arg on the stats socket line: UNIX uid/gid the socket is owned by","provider":"go.mondoo.com/cnquery/v9/providers/os"},"statsTimeout":{"name":"statsTimeout","type":"\u0007","is_mandatory":true,"title":"`stats timeout` value (string with time unit)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tuneSslDefaultDhParam":{"name":"tuneSslDefaultDhParam","type":"\u0005","is_mandatory":true,"title":"`tune.ssl.default-dh-param` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"`user` directive value (UNIX uid)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"HAProxy global section","desc":"Global section: process settings (daemon, user/group, chroot, pidfile), connection limits, threading, the runtime stats socket, the default SSL options applied to every bind and server, and the log destinations. The default-SSL fields matter for hardening because they set the baseline any bind or server inherits when it doesn't override them locally.","private":true,"min_provider_version":"13.19.1","defaults":"daemon maxconn nbthread","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy.config.listen":{"id":"haproxy.config.listen","name":"haproxy.config.listen","fields":{"acls":{"name":"acls","type":"\u0019\n","is_mandatory":true,"title":"`acl` definitions","provider":"go.mondoo.com/cnquery/v9/providers/os"},"balance":{"name":"balance","type":"\u0007","is_mandatory":true,"title":"`balance` algorithm","provider":"go.mondoo.com/cnquery/v9/providers/os"},"binds":{"name":"binds","type":"\u0019\u001bhaproxy.config.bind","is_mandatory":true,"title":"`bind` directives, broken out per address form","provider":"go.mondoo.com/cnquery/v9/providers/os"},"defaultServer":{"name":"defaultServer","type":"\n","is_mandatory":true,"title":"`default-server` directive parsed as a flag bag","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disabledOptions":{"name":"disabledOptions","type":"\u0019\u0007","is_mandatory":true,"title":"`no option \u003cname\u003e` directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"Source file path where this listen section is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpCheck":{"name":"httpCheck","type":"\n","is_mandatory":true,"title":"Consolidated HTTP health check","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpRequestRules":{"name":"httpRequestRules","type":"\u0019\u0007","is_mandatory":true,"title":"`http-request \u003crule\u003e` lines","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpResponseRules":{"name":"httpResponseRules","type":"\u0019\u0007","is_mandatory":true,"title":"`http-response \u003crule\u003e` lines","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inherits":{"name":"inherits","type":"\u0007","is_mandatory":true,"title":"`from \u003cdefaults\u003e` argument when present","provider":"go.mondoo.com/cnquery/v9/providers/os"},"log":{"name":"log","type":"\u0019\u0007","is_mandatory":true,"title":"`log` directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"`mode` value (tcp, http)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Listen section name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"`option \u003cname\u003e [args]` directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this listen, keyed by directive name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"servers":{"name":"servers","type":"\u0019\u001bhaproxy.config.server","is_mandatory":true,"title":"Backend servers","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tcpRequestRules":{"name":"tcpRequestRules","type":"\u0019\u0007","is_mandatory":true,"title":"`tcp-request \u003crule\u003e` lines","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tcpResponseRules":{"name":"tcpResponseRules","type":"\u0019\u0007","is_mandatory":true,"title":"`tcp-response \u003crule\u003e` lines","provider":"go.mondoo.com/cnquery/v9/providers/os"},"timeouts":{"name":"timeouts","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"`timeout \u003ckind\u003e \u003cvalue\u003e` map keyed by kind","provider":"go.mondoo.com/cnquery/v9/providers/os"},"useBackends":{"name":"useBackends","type":"\u0019\n","is_mandatory":true,"title":"`use_backend` rules","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"HAProxy listen section","desc":"Combined frontend and backend section. Exposes the same audit surface as a backend (servers, balance, health checks) plus the frontend's `bind` listeners and ACL/routing surface, for the shorthand where a single section both accepts client traffic and defines its server pool.","private":true,"min_provider_version":"13.19.1","defaults":"name mode","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy.config.peersSection":{"id":"haproxy.config.peersSection","name":"haproxy.config.peersSection","fields":{"bind":{"name":"bind","type":"\u0007","is_mandatory":true,"title":"`bind` argument (raw; peers binds are simpler than frontend binds)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"Source file path where this peers section is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Peers section name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this peers section, keyed by directive name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"servers":{"name":"servers","type":"\u0019\u001bhaproxy.config.server","is_mandatory":true,"title":"`server \u003cname\u003e \u003caddr\u003e:\u003cport\u003e` entries (same shape as backend servers)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tables":{"name":"tables","type":"\u0019\n","is_mandatory":true,"title":"`table \u003cname\u003e ...` entries. Entries: {name, type, size, expire, store, raw}","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"HAProxy peers section","desc":"Peers section used for stick-table replication between HAProxy instances. Exposes the peer servers and the replicated stick-table definitions.","private":true,"min_provider_version":"13.19.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy.config.resolversSection":{"id":"haproxy.config.resolversSection","name":"haproxy.config.resolversSection","fields":{"acceptedPayloadSize":{"name":"acceptedPayloadSize","type":"\u0005","is_mandatory":true,"title":"`accepted_payload_size` value (UDP DNS payload cap in bytes)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"Source file path where this resolvers section is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"holds":{"name":"holds","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"`hold \u003cstate\u003e \u003cduration\u003e` map keyed by state (valid, nx, refused, timeout, obsolete, other)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resolvers section name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nameservers":{"name":"nameservers","type":"\u0019\n","is_mandatory":true,"title":"`nameserver \u003cname\u003e \u003caddr\u003e[:\u003cport\u003e]` entries. Entries: {name, address, port}","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this resolvers section, keyed by directive name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"resolveRetries":{"name":"resolveRetries","type":"\u0005","is_mandatory":true,"title":"`resolve_retries` value (number of retries per nameserver)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"timeouts":{"name":"timeouts","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"`timeout \u003ckind\u003e \u003cvalue\u003e` map (resolve, retry)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"HAProxy resolvers section","desc":"DNS resolver pool used by `server` directives that resolve hostnames at runtime via `resolvers \u003cname\u003e`. Exposes the configured nameservers, retry/timeout tuning, and caching (`hold`) policy.","private":true,"min_provider_version":"13.19.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy.config.section":{"id":"haproxy.config.section","name":"haproxy.config.section","fields":{"directives":{"name":"directives","type":"\u0019\n","is_mandatory":true,"title":"Every directive in source order (entries: {name, args, line, file, raw})","provider":"go.mondoo.com/cnquery/v9/providers/os"},"endLine":{"name":"endLine","type":"\u0005","is_mandatory":true,"title":"1-based source line of the last directive in the section","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"Source file path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inherits":{"name":"inherits","type":"\u0007","is_mandatory":true,"title":"`from \u003cother\u003e` argument when present on the section header (named-defaults inheritance)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Section name (empty for global; may be empty for the classic unnamed defaults block)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Flat directive map (name -\u003e joined args; values comma-concatenated when the directive repeats)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Raw text of the section including its header line","provider":"go.mondoo.com/cnquery/v9/providers/os"},"startLine":{"name":"startLine","type":"\u0005","is_mandatory":true,"title":"1-based source line where the section header appears","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Section keyword (global, defaults, frontend, backend, listen, resolvers, userlist, peers, mailers, cache, ...)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"HAProxy configuration section (raw view)","desc":"Arbitrary section addressed by type and name. Useful for sections not modeled as their own resources (mailers, cache, program, ring, http-errors, fcgi-app, crt-store) and for low-level audits that need every directive in source order.","private":true,"min_provider_version":"13.19.1","defaults":"type name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy.config.server":{"id":"haproxy.config.server","name":"haproxy.config.server","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Server address: hostname, IPv4, \"[IPv6]\", \"unix@/path\", or \"abns@...\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"agentAddr":{"name":"agentAddr","type":"\u0007","is_mandatory":true,"title":"`agent-addr` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"agentCheck":{"name":"agentCheck","type":"\u0004","is_mandatory":true,"title":"Whether the `agent-check` flag enables an external agent health check","provider":"go.mondoo.com/cnquery/v9/providers/os"},"agentInter":{"name":"agentInter","type":"\u0007","is_mandatory":true,"title":"`agent-inter` value (agent-check interval)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"agentPort":{"name":"agentPort","type":"\u0005","is_mandatory":true,"title":"`agent-port` value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"alpn":{"name":"alpn","type":"\u0007","is_mandatory":true,"title":"`alpn` argument","provider":"go.mondoo.com/cnquery/v9/providers/os"},"backup":{"name":"backup","type":"\u0004","is_mandatory":true,"title":"Whether the `backup` flag is set (only used when no non-backup server is up)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"caFile":{"name":"caFile","type":"\u0007","is_mandatory":true,"title":"`ca-file` argument (CA bundle for backend cert verification)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"check":{"name":"check","type":"\u0004","is_mandatory":true,"title":"Whether the `check` flag enables active health checking","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cookie":{"name":"cookie","type":"\u0007","is_mandatory":true,"title":"`cookie` value (cookie identifier for stickiness)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"crt":{"name":"crt","type":"\u0007","is_mandatory":true,"title":"`crt` argument (client cert presented to the backend)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disabled":{"name":"disabled","type":"\u0004","is_mandatory":true,"title":"Whether the `disabled` flag marks the server admin-down","provider":"go.mondoo.com/cnquery/v9/providers/os"},"downInter":{"name":"downInter","type":"\u0007","is_mandatory":true,"title":"`downinter` value (interval while marked down)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fall":{"name":"fall","type":"\u0005","is_mandatory":true,"title":"`fall` value (consecutive failed checks required to mark DOWN)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fastInter":{"name":"fastInter","type":"\u0007","is_mandatory":true,"title":"`fastinter` value (interval immediately after a state change)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"initAddr":{"name":"initAddr","type":"\u0007","is_mandatory":true,"title":"`init-addr` value (address resolution order at startup)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inter":{"name":"inter","type":"\u0007","is_mandatory":true,"title":"`inter` value (regular health-check interval, e.g. \"2s\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"maxconn":{"name":"maxconn","type":"\u0005","is_mandatory":true,"title":"`maxconn` value (per-server concurrent connection cap)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"maxqueue":{"name":"maxqueue","type":"\u0005","is_mandatory":true,"title":"`maxqueue` value (queue cap before failing over)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Server name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"observe":{"name":"observe","type":"\u0007","is_mandatory":true,"title":"`observe` value (passive observation: l4, l7)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"onError":{"name":"onError","type":"\u0007","is_mandatory":true,"title":"`on-error` value (action on observed errors: fastinter, fail-check, sudden-death, mark-down)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"onMarkedDown":{"name":"onMarkedDown","type":"\u0007","is_mandatory":true,"title":"`on-marked-down` value (action when the server transitions to DOWN)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"onMarkedUp":{"name":"onMarkedUp","type":"\u0007","is_mandatory":true,"title":"`on-marked-up` value (action when the server transitions to UP)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All key=value flags on the server line (catch-all)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Server port (0 for unix sockets or address-only declarations)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"resolvers":{"name":"resolvers","type":"\u0007","is_mandatory":true,"title":"`resolvers` name (resolvers section used for hostname resolution)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rise":{"name":"rise","type":"\u0005","is_mandatory":true,"title":"`rise` value (consecutive UP checks required to mark UP)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sendProxy":{"name":"sendProxy","type":"\u0004","is_mandatory":true,"title":"Whether the `send-proxy` flag sends a PROXY v1 header to the backend","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sendProxyV2":{"name":"sendProxyV2","type":"\u0004","is_mandatory":true,"title":"Whether the `send-proxy-v2` flag sends a PROXY v2 header to the backend","provider":"go.mondoo.com/cnquery/v9/providers/os"},"slowStart":{"name":"slowStart","type":"\u0007","is_mandatory":true,"title":"`slowstart` value (ramp-up period after a server comes back up)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sni":{"name":"sni","type":"\u0007","is_mandatory":true,"title":"`sni` argument (SNI value to send)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ssl":{"name":"ssl","type":"\u0004","is_mandatory":true,"title":"Whether the `ssl` flag enables TLS to reach this server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"verify":{"name":"verify","type":"\u0007","is_mandatory":true,"title":"`verify` argument for the backend TLS connection (none, required)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"weight":{"name":"weight","type":"\u0005","is_mandatory":true,"title":"`weight` value (load-balancing weight; 0 means draining)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"HAProxy backend server","desc":"Single member of a backend server pool. Captures the server identity (name/address/port), TLS posture toward the backend (ssl, verify, ca-file, sni, alpn), the health check tuning (inter/rise/fall/observe), connection limits, and persistence hooks. Useful for confirming that upstream connections are encrypted, verified, and actively health-checked.","private":true,"min_provider_version":"13.19.1","defaults":"name address port check ssl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haproxy.config.userlist":{"id":"haproxy.config.userlist","name":"haproxy.config.userlist","fields":{"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"Source file path where this userlist is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"groups":{"name":"groups","type":"\u0019\n","is_mandatory":true,"title":"`group \u003cname\u003e [users \u003cu1,u2\u003e]` entries. Entries: {name, users}","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Userlist name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"users":{"name":"users","type":"\u0019\n","is_mandatory":true,"title":"`user \u003cname\u003e (password|insecure-password) \u003csecret\u003e [groups \u003cg1,g2\u003e]` entries. Entries: {name, password, hashed, groups}","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"HAProxy userlist section","desc":"HTTP-auth userlist consumed by `http-request auth` / `http-request deny unless { http_auth(\u003clist\u003e) }`. Captures users (with a flag indicating whether the password is hashed) and groups, so you can audit for cleartext (`insecure-password`) credentials.","private":true,"min_provider_version":"13.19.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haskell":{"id":"haskell","fields":{"package":{"name":"package","type":"\u001bhaskell.package","title":"Haskell package dependency","desc":"Single Haskell package locked by a Stack or Cabal project, exposing its unique `id`, `name`, `version`, `purl` identifier, and the lock or freeze files that declared it.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bhaskell.packages","title":"Haskell package inventory (Stack and Cabal)","desc":"Haskell packages locked by a project's stack.yaml.lock or cabal.project.freeze, each with its resolved version. Set `path` to the directory holding the lock or freeze file.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"haskell.package":{"id":"haskell.package","name":"haskell.package","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Lock or freeze files that contributed this package to the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the package within the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Package name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl), a standardized identifier for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Resolved package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Haskell package dependency","desc":"Single Haskell package locked by a Stack or Cabal project, exposing its unique `id`, `name`, `version`, `purl` identifier, and the lock or freeze files that declared it.","min_provider_version":"13.13.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"haskell.packages":{"id":"haskell.packages","name":"haskell.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bhaskell.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for stack.yaml.lock or cabal.project.freeze","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bhaskell.package","title":"Haskell package inventory (Stack and Cabal)","desc":"Haskell packages locked by a project's stack.yaml.lock or cabal.project.freeze, each with its resolved version. Set `path` to the directory holding the lock or freeze file.","min_provider_version":"13.13.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"homebrew":{"id":"homebrew","fields":{"package":{"name":"package","type":"\u001bhomebrew.package","title":"Homebrew package (formula or cask)","desc":"Single installed Homebrew formula or cask, exposing its version, latest available version, install location, tap, pin state, and whether it is outdated or was pulled in only as a dependency.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bhomebrew.packages","title":"Homebrew package inventory (macOS and Linux)","desc":"Homebrew formulae and casks installed on the host, each with version, tap, install path, and update status. Filter for outdated software with `homebrew.packages.where(outdated == true)`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"homebrew.package":{"id":"homebrew.package","name":"homebrew.package","fields":{"appName":{"name":"appName","type":"\u0007","is_mandatory":true,"title":"Application name (casks only)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"autoUpdates":{"name":"autoUpdates","type":"\u0004","is_mandatory":true,"title":"Whether the cask manages its own updates","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Package description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"homepage":{"name":"homepage","type":"\u0007","is_mandatory":true,"title":"Homepage URL","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installedAsDependency":{"name":"installedAsDependency","type":"\u0004","is_mandatory":true,"title":"Whether this package was installed as a dependency","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installedOnRequest":{"name":"installedOnRequest","type":"\u0004","is_mandatory":true,"title":"Whether this package was explicitly installed (not a dependency)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"latestVersion":{"name":"latestVersion","type":"\u0007","is_mandatory":true,"title":"Latest stable version available (equals version when up-to-date)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Package name (formula name or cask token)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"outdated":{"name":"outdated","type":"\u0004","is_mandatory":true,"title":"Whether a newer version is available","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Install path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pinned":{"name":"pinned","type":"\u0004","is_mandatory":true,"title":"Whether the version is pinned","provider":"go.mondoo.com/cnquery/v9/providers/os"},"prefix":{"name":"prefix","type":"\u0007","is_mandatory":true,"title":"Homebrew install prefix (e.g., \"/opt/homebrew\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","is_mandatory":true,"title":"Package URL (purl), a standardized identifier for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tap":{"name":"tap","type":"\u0007","is_mandatory":true,"title":"Homebrew tap (e.g., \"homebrew/core\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Package type: \"formula\" or \"cask\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Currently installed version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Homebrew package (formula or cask)","desc":"Single installed Homebrew formula or cask, exposing its version, latest available version, install location, tap, pin state, and whether it is outdated or was pulled in only as a dependency.","private":true,"min_provider_version":"13.10.1","defaults":"name version type","provider":"go.mondoo.com/cnquery/v9/providers/os"},"homebrew.packages":{"id":"homebrew.packages","name":"homebrew.packages","fields":{"list":{"name":"list","type":"\u0019\u001bhomebrew.package","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bhomebrew.package","title":"Homebrew package inventory (macOS and Linux)","desc":"Homebrew formulae and casks installed on the host, each with version, tap, install path, and update status. Filter for outdated software with `homebrew.packages.where(outdated == true)`.","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ibm":{"id":"ibm","fields":{"bob":{"name":"bob","type":"\u001bibm.bob","title":"IBM Bob instance","desc":"IBM Bob, IBM's AI development assistant, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .bob in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://www.ibm.com/products/bob","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"}},"is_extension":true},"ibm.bob":{"id":"ibm.bob","name":"ibm.bob","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Bob configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bibm.bob.skill","title":"IBM Bob skill","desc":"A single SKILL.md definition discovered for the IBM Bob agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bibm.bob.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"IBM Bob instance","desc":"IBM Bob, IBM's AI development assistant, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .bob in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://www.ibm.com/products/bob","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"ibm.bob.skill":{"id":"ibm.bob.skill","name":"ibm.bob.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"IBM Bob skill","desc":"A single SKILL.md definition discovered for the IBM Bob agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"inetd":{"id":"inetd","name":"inetd","fields":{"config":{"name":"config","type":"\u001binetd.config","title":"inetd super-server configuration","desc":"Services the inetd (or compatible) super-server is configured to launch on demand. Each active entry pairs a service with its socket type, protocol, wait mode, run-as user, and server program. The configuration is assembled from /etc/inetd.conf together with any drop-in files under /etc/inetd.d. A missing configuration yields no entries, so audits such as serviceNames.none(\"ftp\") hold trivially on systems that don't run inetd.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"title":"inetd super-server namespace","desc":"Namespace hosting `inetd.config`, the entry point for examining which network services the inetd super-server launches on demand.","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inetd.config":{"id":"inetd.config","name":"inetd.config","fields":{"content":{"name":"content","type":"\u0007","refs":["\"files\""],"title":"Merged contents of all configuration files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entries":{"name":"entries","type":"\u0019\u001binetd.config.entry","refs":["\"files\""],"title":"Active service entries","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entry":{"name":"entry","type":"\u001binetd.config.entry","title":"inetd service entry","desc":"Single active inetd service line: the service it exposes and how inetd launches it. The name field selects the service as it appears in the first column of inetd.conf, for example inetd.config.entries.where(name == \"ftp\"). Entries that are commented out with a leading # are disabled and excluded.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"file":{"name":"file","type":"\u001bfile","title":"Primary inetd configuration file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bfile","refs":["\"file\""],"title":"All files making up the inetd configuration (main file and drop-ins)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serviceNames":{"name":"serviceNames","type":"\u0019\u0007","refs":["\"entries\""],"title":"Names of the active services","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"inetd super-server configuration","desc":"Services the inetd (or compatible) super-server is configured to launch on demand. Each active entry pairs a service with its socket type, protocol, wait mode, run-as user, and server program. The configuration is assembled from /etc/inetd.conf together with any drop-in files under /etc/inetd.d. A missing configuration yields no entries, so audits such as serviceNames.none(\"ftp\") hold trivially on systems that don't run inetd.","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inetd.config.entry":{"id":"inetd.config.entry","name":"inetd.config.entry","fields":{"arguments":{"name":"arguments","type":"\u0007","is_mandatory":true,"title":"Arguments passed to the server program","provider":"go.mondoo.com/cnquery/v9/providers/os"},"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Service name or port (first column)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Transport protocol, such as tcp, udp, tcp6, or udp6","provider":"go.mondoo.com/cnquery/v9/providers/os"},"server":{"name":"server","type":"\u0007","is_mandatory":true,"title":"Server program path, or \"internal\" for built-in services","provider":"go.mondoo.com/cnquery/v9/providers/os"},"socketType":{"name":"socketType","type":"\u0007","is_mandatory":true,"title":"Socket type, such as stream, dgram, or raw","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"User the server runs as, with an optional group suffix","provider":"go.mondoo.com/cnquery/v9/providers/os"},"wait":{"name":"wait","type":"\u0007","is_mandatory":true,"title":"Wait mode, either wait or nowait, with an optional max-connections suffix","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"inetd service entry","desc":"Single active inetd service line: the service it exposes and how inetd launches it. The name field selects the service as it appears in the first column of inetd.conf, for example inetd.config.entries.where(name == \"ftp\"). Entries that are commented out with a leading # are disabled and excluded.","private":true,"min_provider_version":"13.24.1","defaults":"name protocol server","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ip6tables":{"id":"ip6tables","name":"ip6tables","fields":{"forward":{"name":"forward","type":"\u0019\u001biptables.entry","title":"IPv6 forward chain entries (filter table)","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"forwardPolicy":{"name":"forwardPolicy","type":"\u0007","title":"Default policy for the FORWARD chain (e.g., ACCEPT, DROP)","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"input":{"name":"input","type":"\u0019\u001biptables.entry","title":"IPv6 input chain entries (filter table)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inputPolicy":{"name":"inputPolicy","type":"\u0007","title":"Default policy for the INPUT chain (e.g., ACCEPT, DROP)","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"output":{"name":"output","type":"\u0019\u001biptables.entry","title":"IPv6 output chain entries (filter table)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"outputPolicy":{"name":"outputPolicy","type":"\u0007","title":"Default policy for the OUTPUT chain (e.g., ACCEPT, DROP)","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tables":{"name":"tables","type":"\u0019\u001biptables.table","title":"All tables (filter, nat, mangle, raw)","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"IPv6 packet filter (ip6tables)","desc":"The host's IPv6 ip6tables ruleset: every `tables` entry (filter, nat, mangle, raw) with its chains and rules, plus shortcuts to the filter table's `input`, `output`, and `forward` chains and their default policies. Audit it alongside `iptables` so IPv6 traffic is filtered as strictly as IPv4.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ipAddress":{"id":"ipAddress","name":"ipAddress","fields":{"broadcast":{"name":"broadcast","type":"\u000f","is_mandatory":true,"title":"Network address used to transmit to all devices connected to a network","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cidr":{"name":"cidr","type":"\u000f","is_mandatory":true,"title":"Classless Inter-Domain Routing notation (e.g. 172.31.24.71/20 or 2001:0:2851:782c:869:1f7d:a331:f3e1/64)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"gateway":{"name":"gateway","type":"\u000f","is_mandatory":true,"title":"IP address that acts as the entry point to another, or external, network","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ip":{"name":"ip","type":"\u000f","is_mandatory":true,"title":"Unique number that identifies a device on a network (e.g. 172.31.24.71 or 2001:0:2851:782c:869:1f7d:a331:f3e1)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"subnet":{"name":"subnet","type":"\u000f","is_mandatory":true,"title":"Logical subdivision of a network (e.g. 172.31.16.0/20 or 2001:db8::/64)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"IP address (v4 or v6) with networking details","desc":"IP address plus its network context: the address itself, the subnet it belongs to, the address in CIDR notation, the broadcast address, and the gateway. Works for both IPv4 and IPv6.","min_provider_version":"11.3.42","defaults":"ip","provider":"go.mondoo.com/cnquery/v9/providers/os"},"iptables":{"id":"iptables","name":"iptables","fields":{"chain":{"name":"chain","type":"\u001biptables.chain","title":"iptables chain within a table","desc":"A chain of ordered `rules` within a table, matched against packets in sequence. Built-in chains (INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING) carry a default `policy` applied when no rule matches; user-defined chains have an empty policy and are reached only via a jump target.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"entry":{"name":"entry","type":"\u001biptables.entry","title":"Individual iptables rule entry","desc":"A single iptables rule with its packet and byte counters, target action, protocol, input/output interfaces, source and destination addresses, matched ports, conntrack state, TCP flags, and comment. Reached from `iptables.input`, `iptables.output`, or `iptables.forward` to audit individual packet-filter rules, for example finding rules that accept traffic from anywhere with `iptables.input.where(target == \"ACCEPT\" \u0026\u0026 source == \"0.0.0.0/0\")`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"forward":{"name":"forward","type":"\u0019\u001biptables.entry","title":"IPv4 forward chain entries (filter table)","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"forwardPolicy":{"name":"forwardPolicy","type":"\u0007","title":"Default policy for the FORWARD chain (e.g., ACCEPT, DROP)","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"input":{"name":"input","type":"\u0019\u001biptables.entry","title":"IPv4 input chain entries (filter table)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inputPolicy":{"name":"inputPolicy","type":"\u0007","title":"Default policy for the INPUT chain (e.g., ACCEPT, DROP)","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"output":{"name":"output","type":"\u0019\u001biptables.entry","title":"IPv4 output chain entries (filter table)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"outputPolicy":{"name":"outputPolicy","type":"\u0007","title":"Default policy for the OUTPUT chain (e.g., ACCEPT, DROP)","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"table":{"name":"table","type":"\u001biptables.table","title":"iptables table (filter, nat, mangle, raw)","desc":"One iptables table and the `chains` it contains. The `name` selects the table's purpose: `filter` for packet acceptance/dropping, `nat` for address translation, `mangle` for packet header changes, and `raw` for connection tracking exemptions.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"tables":{"name":"tables","type":"\u0019\u001biptables.table","title":"All tables (filter, nat, mangle, raw)","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"IPv4 packet filter (iptables)","desc":"The host's IPv4 iptables ruleset: every `tables` entry (filter, nat, mangle, raw) with its chains and rules, plus shortcuts to the filter table's `input`, `output`, and `forward` chains and their default policies. A default `inputPolicy` of `ACCEPT` with no restricting rules is a common firewall-hardening finding.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"iptables.chain":{"id":"iptables.chain","name":"iptables.chain","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Chain name (INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING, or user-defined)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"policy":{"name":"policy","type":"\u0007","is_mandatory":true,"title":"Default policy (ACCEPT, DROP, REJECT) - empty for user-defined chains","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rules":{"name":"rules","type":"\u0019\u001biptables.entry","is_mandatory":true,"title":"Rules in this chain","provider":"go.mondoo.com/cnquery/v9/providers/os"},"table":{"name":"table","type":"\u0007","is_mandatory":true,"title":"Table this chain belongs to (filter, nat, mangle, raw)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"iptables chain within a table","desc":"A chain of ordered `rules` within a table, matched against packets in sequence. Built-in chains (INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING) carry a default `policy` applied when no rule matches; user-defined chains have an empty policy and are reached only via a jump target.","private":true,"min_provider_version":"13.15.2","defaults":"table name policy","provider":"go.mondoo.com/cnquery/v9/providers/os"},"iptables.entry":{"id":"iptables.entry","name":"iptables.entry","fields":{"bytes":{"name":"bytes","type":"\u0005","is_mandatory":true,"title":"How large the packet is in octets, including headers and everything.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chain":{"name":"chain","type":"\u0007","is_mandatory":true,"title":"Chain and table identifier used for the resource ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Rule comment from `-m comment --comment`","desc":"The unquoted comment text. Empty when no comment match is present.","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ctstate":{"name":"ctstate","type":"\u0019\u0007","is_mandatory":true,"title":"Conntrack state list from `-m state --state` or `-m conntrack --ctstate`","desc":"Values such as NEW, ESTABLISHED, RELATED, INVALID, UNTRACKED. Empty when no state/ctstate match is present.","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"destination":{"name":"destination","type":"\u0007","is_mandatory":true,"title":"The destination IP address of the traffic, subnet of the traffic, or anywhere","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dport":{"name":"dport","type":"\u0005","is_mandatory":true,"title":"Destination port","desc":"Single port from `--dport`. Null when the rule does not match by destination port, or when it matches a range or list. See `dportRange` for ranges and `dports` for multi-port matches.","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dportRange":{"name":"dportRange","type":"\u0007","is_mandatory":true,"title":"Destination port range, e.g. \"1024:65535\"","desc":"Set when the rule uses `--dport low:high`. Empty otherwise.","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dports":{"name":"dports","type":"\u0019\u0007","is_mandatory":true,"title":"Destination port list from `-m multiport --dports`","desc":"Empty when no `--dports` match is present. Single ports are integers; ranges (e.g. \"1000:2000\") remain as strings unchanged.","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"in":{"name":"in","type":"\u0007","is_mandatory":true,"title":"Input network interface the rule matches on (empty for any)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number of statistic, which is used to create the ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"matchSet":{"name":"matchSet","type":"\u0007","is_mandatory":true,"title":"ipset name from `-m set --match-set`","desc":"The set name used in a `--match-set` match. Empty when no `-m set` match is present.","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"opt":{"name":"opt","type":"\u0007","is_mandatory":true,"title":"IP options","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0007","is_mandatory":true,"title":"Optional settings within the header such as internet timestamps, SACK, or record route options","provider":"go.mondoo.com/cnquery/v9/providers/os"},"out":{"name":"out","type":"\u0007","is_mandatory":true,"title":"Output network interface the rule matches on (empty for any)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"packets":{"name":"packets","type":"\u0005","is_mandatory":true,"title":"Packets from iptable","provider":"go.mondoo.com/cnquery/v9/providers/os"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol of the next level layer (e.g., TCP, UDP, ICMP, etc)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Canonical iptables-save line for this rule","desc":"The exact `-A CHAIN ...` line as emitted by `iptables-save -c`. Empty on systems where `iptables-save` is unavailable and the legacy `-L` parser is used as a fallback.","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rejectWith":{"name":"rejectWith","type":"\u0007","is_mandatory":true,"title":"For `-j REJECT`, the `--reject-with` value (e.g., icmp-port-unreachable)","desc":"Empty when target is not REJECT, or when REJECT is used without `--reject-with`.","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Source address field that tells the receiver where the packet came from","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sport":{"name":"sport","type":"\u0005","is_mandatory":true,"title":"Source port","desc":"Single port from `--sport`. Null when the rule does not match by source port, or when it matches a range or list.","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sportRange":{"name":"sportRange","type":"\u0007","is_mandatory":true,"title":"Source port range, e.g. \"1024:65535\"","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sports":{"name":"sports","type":"\u0019\u0007","is_mandatory":true,"title":"Source port list from `-m multiport --sports`","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"What to do with the packet if it matches a rule","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tcpFlags":{"name":"tcpFlags","type":"\u0019\u0007","is_mandatory":true,"title":"TCP flag match from `-m tcp --tcp-flags`","desc":"Two-element list: [mask, comp] (e.g., [\"FIN,SYN,RST,ACK\", \"SYN\"] for `--tcp-flags FIN,SYN,RST,ACK SYN`). Empty when no `--tcp-flags` match is present.","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Individual iptables rule entry","desc":"A single iptables rule with its packet and byte counters, target action, protocol, input/output interfaces, source and destination addresses, matched ports, conntrack state, TCP flags, and comment. Reached from `iptables.input`, `iptables.output`, or `iptables.forward` to audit individual packet-filter rules, for example finding rules that accept traffic from anywhere with `iptables.input.where(target == \"ACCEPT\" \u0026\u0026 source == \"0.0.0.0/0\")`.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"iptables.table":{"id":"iptables.table","name":"iptables.table","fields":{"chains":{"name":"chains","type":"\u0019\u001biptables.chain","is_mandatory":true,"title":"Chains in this table","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Table name (filter, nat, mangle, raw)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"iptables table (filter, nat, mangle, raw)","desc":"One iptables table and the `chains` it contains. The `name` selects the table's purpose: `filter` for packet acceptance/dropping, `nat` for address translation, `mangle` for packet header changes, and `raw` for connection tracking exemptions.","private":true,"min_provider_version":"13.15.2","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"java":{"id":"java","fields":{"package":{"name":"package","type":"\u001bjava.package","title":"Java package (Maven, Gradle, or JAR archive)","desc":"A single Java artifact: its unique `id`, `name` in `groupId:artifactId` form, `version`, `purl`, CPEs, and the files that contributed it. Iterated from `java.packages` for the full tree or from `directDependencies` for direct dependencies only.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bjava.packages","title":"Java package inventory (Maven, Gradle, JAR archives)","desc":"Java artifacts discovered from Maven, Gradle, or JAR sources: the `root` project, the `directDependencies`, and the full transitive tree (iterated from the list itself). Point `path` at a directory, a JAR, a `pom.xml`, or a `gradle.lockfile`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"java.package":{"id":"java.package","name":"java.package","fields":{"cpes":{"name":"cpes","type":"\u0019\u001bcpe","title":"Common Platform Enumeration (CPE) for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Package files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID is the java.package unique identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Name of the package (groupId:artifactId)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Version of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Java package (Maven, Gradle, or JAR archive)","desc":"A single Java artifact: its unique `id`, `name` in `groupId:artifactId` form, `version`, `purl`, CPEs, and the files that contributed it. Iterated from `java.packages` for the full tree or from `directDependencies` for direct dependencies only.","min_provider_version":"13.10.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"java.packages":{"id":"java.packages","name":"java.packages","fields":{"directDependencies":{"name":"directDependencies","type":"\u0019\u001bjava.package","title":"List of direct dependencies","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bjava.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for Java packages (directory, JAR, pom.xml, or gradle.lockfile)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"root":{"name":"root","type":"\u001bjava.package","title":"Root project (may not exist)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bjava.package","title":"Java package inventory (Maven, Gradle, JAR archives)","desc":"Java artifacts discovered from Maven, Gradle, or JAR sources: the `root` project, the `directDependencies`, and the full transitive tree (iterated from the list itself). Point `path` at a directory, a JAR, a `pom.xml`, or a `gradle.lockfile`.","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"jenkins":{"id":"jenkins","fields":{"package":{"name":"package","type":"\u001bjenkins.package","title":"Jenkins plugin","desc":"Single installed Jenkins plugin, exposing its short name, long display name, version, plugin URL, and the other plugins it depends on.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bjenkins.packages","title":"Jenkins plugin inventory","desc":"Jenkins plugins installed on a controller, each with its version and the other plugins it depends on. Useful for auditing plugin versions against known vulnerabilities. Set `path` to the Jenkins plugins directory.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"jenkins.package":{"id":"jenkins.package","name":"jenkins.package","fields":{"dependencies":{"name":"dependencies","type":"\u0019\u0007","is_mandatory":true,"title":"Plugin dependencies","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","is_mandatory":true,"title":"Files that contributed this plugin to the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"longName":{"name":"longName","type":"\u0007","is_mandatory":true,"title":"Plugin long name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Plugin short name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","is_mandatory":true,"title":"Package URL (purl), a standardized identifier for the plugin","provider":"go.mondoo.com/cnquery/v9/providers/os"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Plugin URL","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Plugin version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Jenkins plugin","desc":"Single installed Jenkins plugin, exposing its short name, long display name, version, plugin URL, and the other plugins it depends on.","private":true,"min_provider_version":"13.12.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"jenkins.packages":{"id":"jenkins.packages","name":"jenkins.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bjenkins.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to Jenkins plugins directory","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bjenkins.package","title":"Jenkins plugin inventory","desc":"Jenkins plugins installed on a controller, each with its version and the other plugins it depends on. Useful for auditing plugin versions against known vulnerabilities. Set `path` to the Jenkins plugins directory.","min_provider_version":"13.12.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"journald":{"id":"journald","fields":{"config":{"name":"config","type":"\u001bjournald.config","title":"systemd journald configuration","desc":"Configuration for the systemd journal daemon parsed from journald.conf. Exposes the [Journal] and other sections, letting you audit settings such as log Storage, Compress, retention limits, and forwarding. Access the parsed content through `sections`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"journald.config":{"id":"journald.config","name":"journald.config","fields":{"file":{"name":"file","type":"\u001bfile","title":"File of this journald configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"file\""],"title":"Flattened journald configuration parameters","desc":"Deprecated in favor of `sections`.","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"deprecated"},"section":{"name":"section","type":"\u001bjournald.config.section","title":"journald configuration section","desc":"Single named section (e.g., \"Journal\", \"Upload\") from the journald configuration, including its `params` list of key-value pairs. Used together with `journald.config` to audit individual journald settings within a specific section.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"sections":{"name":"sections","type":"\u0019\u001bjournald.config.section","refs":["\"file\""],"title":"All sections in this journald configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"systemd journald configuration","desc":"Configuration for the systemd journal daemon parsed from journald.conf. Exposes the [Journal] and other sections, letting you audit settings such as log Storage, Compress, retention limits, and forwarding. Access the parsed content through `sections`.","min_provider_version":"11.4.51","provider":"go.mondoo.com/cnquery/v9/providers/os"},"journald.config.section":{"id":"journald.config.section","name":"journald.config.section","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the section (e.g., \"Journal\", \"Upload\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"param":{"name":"param","type":"\u001bjournald.config.section.param","title":"journald configuration parameter","desc":"Single key-value directive within a journald configuration section: the parameter `name` (e.g., \"Storage\", \"Compress\") and its `value`. Iterated from `journald.config.section.params` to assert specific journald settings.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"params":{"name":"params","type":"\u0019\u001bjournald.config.section.param","is_mandatory":true,"title":"Key-value pairs in this section","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"journald configuration section","desc":"Single named section (e.g., \"Journal\", \"Upload\") from the journald configuration, including its `params` list of key-value pairs. Used together with `journald.config` to audit individual journald settings within a specific section.","min_provider_version":"11.4.69","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"journald.config.section.param":{"id":"journald.config.section.param","name":"journald.config.section.param","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Configuration parameter name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Configuration parameter value","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"journald configuration parameter","desc":"Single key-value directive within a journald configuration section: the parameter `name` (e.g., \"Storage\", \"Compress\") and its `value`. Iterated from `journald.config.section.params` to assert specific journald settings.","min_provider_version":"11.4.69","defaults":"name value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"julia":{"id":"julia","fields":{"package":{"name":"package","type":"\u001bjulia.package","title":"Julia package","desc":"Single Julia package resolved from `Manifest.toml`, with its `name`, locked `version`, and a `purl` (Package URL) for SBOM and vulnerability matching, plus the `files` that declared it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bjulia.packages","title":"Julia package inventory","desc":"Locked Julia packages read from `Manifest.toml` with their resolved versions. With no `path` set, scans common app and per-user environment paths (`/usr/src/app`, `/home/*/app`, `/home/*/.julia/environments/v*`); pass `path` to target a specific project directory or `Manifest.toml`. Each entry carries a `purl` for SBOM and vulnerability matching.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"julia.package":{"id":"julia.package","name":"julia.package","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files that declared the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Package name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl) identifying the package for SBOM and vulnerability matching","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Resolved package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Julia package","desc":"Single Julia package resolved from `Manifest.toml`, with its `name`, locked `version`, and a `purl` (Package URL) for SBOM and vulnerability matching, plus the `files` that declared it.","private":true,"min_provider_version":"13.13.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"julia.packages":{"id":"julia.packages","name":"julia.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Manifest files used to build the package list","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bjulia.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Filesystem path searched for Manifest.toml (empty scans the default paths)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bjulia.package","title":"Julia package inventory","desc":"Locked Julia packages read from `Manifest.toml` with their resolved versions. With no `path` set, scans common app and per-user environment paths (`/usr/src/app`, `/home/*/app`, `/home/*/.julia/environments/v*`); pass `path` to target a specific project directory or `Manifest.toml`. Each entry carries a `purl` for SBOM and vulnerability matching.","min_provider_version":"13.13.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"junie":{"id":"junie","name":"junie","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Junie configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bjunie.skill","title":"Junie skill","desc":"A single SKILL.md definition discovered for the Junie agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bjunie.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Junie (JetBrains AI agent) instance","desc":"Junie, JetBrains' AI coding agent, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .junie in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://www.jetbrains.com/junie/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"junie.skill":{"id":"junie.skill","name":"junie.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Junie skill","desc":"A single SKILL.md definition discovered for the Junie agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"kernel":{"id":"kernel","name":"kernel","fields":{"aslr":{"name":"aslr","type":"\u001bkernel.aslr","title":"Address Space Layout Randomization (ASLR) state (Linux only)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cmdline":{"name":"cmdline","type":"\u001bkernel.cmdline","title":"Kernel boot command line (Linux only)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"info":{"name":"info","type":"\n","title":"Active kernel information (version, path, device, arguments)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installed":{"name":"installed","type":"\u0019\n","title":"Installed kernel versions","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lockdown":{"name":"lockdown","type":"\u001bkernel.lockdown","title":"Kernel lockdown LSM mode (Linux only)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"module":{"name":"module","type":"\u001bkernel.module","title":"System kernel module information","desc":"Single kernel module: its `name`, in-memory `size`, and whether it is currently `loaded`. Initialize by name (e.g., `kernel.module(name: \"nf_conntrack\")`) to check a specific module, or iterate from `kernel.modules` to audit the full loaded-module list. Use `blacklisted`, `installBypass`, and `disabled` to express CIS-style \"module must not load\" controls without falling back to raw modprobe.d file parsing. Use `onDisk` to tell whether a loadable module file is available for the running kernel even when it isn't currently loaded, and `builtIn` to detect functionality compiled directly into the kernel (which is always active and cannot be blacklisted or unloaded).","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"modules":{"name":"modules","type":"\u0019\u001bkernel.module","title":"List of kernel modules","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parameters":{"name":"parameters","type":"\u001a\u0007\u0007","title":"Kernel parameters map (sysctl key-value pairs)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"taint":{"name":"taint","type":"\u001bkernel.taint","title":"Kernel taint status (Linux only)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Running kernel and its modules","desc":"Running kernel and its configuration surface. Exposes kernel version info, sysctl `parameters`, `modules`, installed kernel versions, and, on Linux, hardening state (`cmdline`, `taint`, `lockdown`, `aslr`).","min_provider_version":"9.0.0","defaults":"info","provider":"go.mondoo.com/cnquery/v9/providers/os"},"kernel.aslr":{"id":"kernel.aslr","name":"kernel.aslr","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether ASLR is enabled (`mode \u003e 0`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"level":{"name":"level","type":"\u0007","is_mandatory":true,"title":"Human-readable level","desc":"One of `disabled`, `conservative`, `full`, or `unknown`.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mode":{"name":"mode","type":"\u0005","is_mandatory":true,"title":"Raw ASLR mode value from /proc/sys/kernel/randomize_va_space","desc":"`0` disabled, `1` conservative (stack, libraries, vdso), `2` full (also heap/brk). `-1` when the file is unavailable.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Linux Address Space Layout Randomization (ASLR) state","desc":"Kernel userspace ASLR setting from /proc/sys/kernel/randomize_va_space. ASLR randomizes memory layout to make memory-corruption exploits harder; CIS benchmarks require `mode` 2 (full randomization).","private":true,"min_provider_version":"13.16.10","defaults":"level enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"kernel.cmdline":{"id":"kernel.cmdline","name":"kernel.cmdline","fields":{"flags":{"name":"flags","type":"\u0019\u0007","is_mandatory":true,"title":"Bare flags on the kernel command line (tokens without `=`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parameters":{"name":"parameters","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Parameters parsed from `key=value` tokens","desc":"When a parameter appears multiple times on the command line (e.g. `console=tty0 console=ttyS0`), the last occurrence wins. Use `raw` for full-fidelity inspection.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Raw contents of /proc/cmdline","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Linux kernel boot command line","desc":"Kernel command line passed by the bootloader at boot time (the contents of /proc/cmdline). Use `parameters` for `key=value` directives and `flags` for bare tokens such as `ro`, `quiet`, or `nosmt`. The `raw` string is preserved for direct inspection or for callers that need to recover duplicate tokens.","private":true,"min_provider_version":"13.16.10","defaults":"raw","provider":"go.mondoo.com/cnquery/v9/providers/os"},"kernel.lockdown":{"id":"kernel.lockdown","name":"kernel.lockdown","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether lockdown is enforced (mode is `integrity` or `confidentiality`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Active lockdown mode","desc":"One of `none`, `integrity`, `confidentiality`, or `unavailable`.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Linux kernel lockdown mode","desc":"Kernel lockdown LSM state from /sys/kernel/security/lockdown. Lockdown restricts modifications to a running kernel even from root: `integrity` blocks features that could let userspace modify the kernel (kexec, /dev/mem, etc.) and `confidentiality` additionally blocks features that expose kernel memory contents. `mode` is `unavailable` when the kernel was built without lockdown support.","private":true,"min_provider_version":"13.16.10","defaults":"mode","provider":"go.mondoo.com/cnquery/v9/providers/os"},"kernel.module":{"id":"kernel.module","name":"kernel.module","fields":{"blacklisted":{"name":"blacklisted","type":"\u0004","title":"Whether the module is blacklisted in modprobe configuration","desc":"True when any modprobe configuration file declares `blacklist \u003cname\u003e`. Blacklisted modules will not auto-load (e.g., from udev or hotplug events) but root can still force-load them with `modprobe --force` or by writing to `/sys/module/...`. CIS macOS/Linux benchmarks check for this to ensure unused filesystems/protocols stay off.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"builtIn":{"name":"builtIn","type":"\u0004","title":"Whether the module is compiled into the kernel image","desc":"True when the functionality is built directly into the kernel (configured `=y`) rather than shipped as a loadable file, as listed in the running kernel's `modules.builtin` index. Built-in modules are always active: they never appear in `loaded`, have no file on disk (`onDisk` is false), and cannot be blacklisted or unloaded.","min_provider_version":"13.20.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disabled":{"name":"disabled","type":"\u0004","title":"Whether the module is effectively disabled","desc":"True when the module is either blacklisted or has an install short-circuit rule. Use this as the canonical \"module will not load without explicit override\" predicate.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installBypass":{"name":"installBypass","type":"\u0004","title":"Whether the module's load is short-circuited to /bin/true or /bin/false","desc":"True when any modprobe configuration file declares `install \u003cname\u003e /bin/false` (or `/bin/true`). This is stronger than blacklisting: even an explicit `modprobe \u003cname\u003e` is replaced with the no-op binary, so the module cannot be loaded without overriding the install rule.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"loaded":{"name":"loaded","type":"\u0004","is_mandatory":true,"title":"Whether the module is loaded","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the kernel module","provider":"go.mondoo.com/cnquery/v9/providers/os"},"onDisk":{"name":"onDisk","type":"\u0004","title":"Whether a loadable module file is installed on disk for the running kernel","desc":"True when a `.ko` (or compressed `.ko.xz` / `.ko.zst` / `.ko.gz`) file for this module exists under `/lib/modules/\u003cversion\u003e/`, as listed in that kernel's `modules.dep` index. This reports presence independently of `loaded`, so it answers \"the module is available to load but isn't loaded right now.\" Modules compiled into the kernel have no file on disk and report false here (see `builtIn`).","min_provider_version":"13.20.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"size":{"name":"size","type":"\u0007","is_mandatory":true,"title":"Size of the kernel module","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"System kernel module information","desc":"Single kernel module: its `name`, in-memory `size`, and whether it is currently `loaded`. Initialize by name (e.g., `kernel.module(name: \"nf_conntrack\")`) to check a specific module, or iterate from `kernel.modules` to audit the full loaded-module list. Use `blacklisted`, `installBypass`, and `disabled` to express CIS-style \"module must not load\" controls without falling back to raw modprobe.d file parsing. Use `onDisk` to tell whether a loadable module file is available for the running kernel even when it isn't currently loaded, and `builtIn` to detect functionality compiled directly into the kernel (which is always active and cannot be blacklisted or unloaded).","min_provider_version":"9.0.0","defaults":"name loaded","provider":"go.mondoo.com/cnquery/v9/providers/os"},"kernel.taint":{"id":"kernel.taint","name":"kernel.taint","fields":{"bitmask":{"name":"bitmask","type":"\u0005","is_mandatory":true,"title":"Raw taint bitmask from /proc/sys/kernel/tainted","provider":"go.mondoo.com/cnquery/v9/providers/os"},"reasons":{"name":"reasons","type":"\u0019\u0007","is_mandatory":true,"title":"Human-readable taint reasons in bit order","desc":"See the kernel.org \"Tainted kernels\" documentation for the full list of bit meanings (proprietary module, out-of-tree module, unsigned module, oops, soft lockup, live-patched, etc.).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tainted":{"name":"tainted","type":"\u0004","is_mandatory":true,"title":"Whether any taint bit is set","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Linux kernel taint status","desc":"Kernel taint flags as reported by /proc/sys/kernel/tainted. A non-zero bitmask indicates that the kernel has loaded proprietary or out-of-tree modules, hit a hardware error, oopsed, or otherwise entered a state that diverges from a clean reference kernel. Use `tainted` for a boolean check and `reasons` for the human-readable list of contributing bits.","private":true,"min_provider_version":"13.16.10","defaults":"tainted reasons","provider":"go.mondoo.com/cnquery/v9/providers/os"},"kilocode":{"id":"kilocode","name":"kilocode","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Kilo Code configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bkilocode.skill","title":"Kilo Code skill","desc":"A single SKILL.md definition discovered for the Kilo Code agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bkilocode.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Kilo Code AI agent instance","desc":"Kilo Code, an open-source AI coding agent, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .kilocode in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://kilocode.ai/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"kilocode.skill":{"id":"kilocode.skill","name":"kilocode.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Kilo Code skill","desc":"A single SKILL.md definition discovered for the Kilo Code agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"kiro":{"id":"kiro","name":"kiro","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Kiro configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional, null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bkiro.skill","title":"Kiro skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the agent. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bkiro.skill","title":"Installed skills","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Kiro CLI (AWS) instance","desc":"Kiro AI coding agent from AWS installed on the host. Queryable through it are the installed skills, along with the package that installed the tool and the runtime it executes in. URL: https://kiro.dev/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"kiro.skill":{"id":"kiro.skill","name":"kiro.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint describing the skill's expected arguments","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full markdown content of the skill definition","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content, for integrity checks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Kiro skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the agent. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"kubelet":{"id":"kubelet","name":"kubelet","fields":{"anonymousAuthEnabled":{"name":"anonymousAuthEnabled","type":"\u0004","title":"Whether the kubelet server accepts anonymous, unauthenticated requests","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"authorizationMode":{"name":"authorizationMode","type":"\u0007","title":"Authorization mode the kubelet enforces on incoming requests","desc":"Either \"Webhook\" (delegate authorization to the API server) or \"AlwaysAllow\" (no authorization, every authenticated request is granted).","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"clientCAFile":{"name":"clientCAFile","type":"\u0007","title":"Path to the CA bundle used to verify client certificates on the kubelet server","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"configFile":{"name":"configFile","type":"\u001bfile","is_mandatory":true,"title":"Kubelet config file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"configuration":{"name":"configuration","type":"\n","title":"Combination of config file parameters and CLI parameters","provider":"go.mondoo.com/cnquery/v9/providers/os"},"eventRecordQPS":{"name":"eventRecordQPS","type":"\u0005","title":"Maximum number of event creations per second the kubelet allows; 0 means unlimited","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"makeIPTablesUtilChains":{"name":"makeIPTablesUtilChains","type":"\u0004","title":"Whether the kubelet manages the iptables utility chains on the node","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"process":{"name":"process","type":"\u001bprocess","is_mandatory":true,"title":"Kubelet process","provider":"go.mondoo.com/cnquery/v9/providers/os"},"protectKernelDefaults":{"name":"protectKernelDefaults","type":"\u0004","title":"Whether the kubelet refuses to start when kernel tunables differ from its expected values","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"readOnlyPort":{"name":"readOnlyPort","type":"\u0005","title":"Read-only, unauthenticated port that serves the kubelet API; 0 disables it","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rotateCertificates":{"name":"rotateCertificates","type":"\u0004","title":"Whether the kubelet automatically rotates its client certificates as they near expiry","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverTLSBootstrap":{"name":"serverTLSBootstrap","type":"\u0004","title":"Whether the kubelet requests a serving certificate from the certificates API instead of self-signing","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"streamingConnectionIdleTimeout":{"name":"streamingConnectionIdleTimeout","type":"\u0007","title":"Idle timeout after which the kubelet closes streaming connections (for example \"4h0m0s\"); \"0\" disables it","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tlsCertFile":{"name":"tlsCertFile","type":"\u0007","title":"Path to the x509 certificate the kubelet uses to serve HTTPS","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tlsCipherSuites":{"name":"tlsCipherSuites","type":"\u0019\u0007","title":"TLS cipher suites the kubelet server accepts","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tlsMinVersion":{"name":"tlsMinVersion","type":"\u0007","title":"Minimum TLS version the kubelet server accepts (for example \"VersionTLS12\")","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tlsPrivateKeyFile":{"name":"tlsPrivateKeyFile","type":"\u0007","title":"Path to the private key matching the kubelet serving certificate","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Kubelet version reported by the running binary (for example \"v1.34.0\")","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Kubernetes kubelet on this node","desc":"The kubelet agent running on this node, with its security-relevant settings resolved from the config file merged with the live process's CLI flags (CLI flags take precedence). The fields map to CIS Kubernetes benchmark controls: anonymous authentication, authorization mode, client CA, the read-only port, streaming timeouts, certificate rotation, and the TLS cipher/version floor. `configuration` returns the full merged configuration as a dict.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"launchd":{"id":"launchd","name":"launchd","fields":{"job":{"name":"job","type":"\u001blaunchd.job","title":"Individual launchd job configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"jobs":{"name":"jobs","type":"\u0019\u001blaunchd.job","title":"All launchd jobs from system and user directories","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS launchd job configurations","desc":"launchd service manager on macOS. The `jobs` collection parses daemon and agent job definitions from their plist files across the system, library, and per-user launchd directories, so audits can review autostarted programs, the accounts they run as, and their launch conditions in one place.","min_provider_version":"11.8.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"launchd.job":{"id":"launchd.job","name":"launchd.job","fields":{"content":{"name":"content","type":"\n","is_mandatory":true,"title":"Full parsed plist content","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disabled":{"name":"disabled","type":"\u0004","is_mandatory":true,"title":"Whether the job is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"environmentVariables":{"name":"environmentVariables","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Environment variables","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"The plist file resource","provider":"go.mondoo.com/cnquery/v9/providers/os"},"groupName":{"name":"groupName","type":"\u0007","is_mandatory":true,"title":"Group the job runs as","provider":"go.mondoo.com/cnquery/v9/providers/os"},"keepAlive":{"name":"keepAlive","type":"\n","is_mandatory":true,"title":"Keep alive configuration","desc":"Normalized to: {\"enabled\": bool} for simple values, {\"enabled\": true, \"conditions\": {...}} for conditional keep-alive, or null if not specified.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the job (from Label key)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"machServices":{"name":"machServices","type":"\n","is_mandatory":true,"title":"Mach services","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the plist file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"processType":{"name":"processType","type":"\u0007","is_mandatory":true,"title":"macOS launchd process type (e.g., Adaptive, Interactive, Background, Standard)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"program":{"name":"program","type":"\u0007","is_mandatory":true,"title":"The program to execute","provider":"go.mondoo.com/cnquery/v9/providers/os"},"programArguments":{"name":"programArguments","type":"\u0019\u0007","is_mandatory":true,"title":"Command arguments","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rootDirectory":{"name":"rootDirectory","type":"\u0007","is_mandatory":true,"title":"Directory to chroot to before launch","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runAtLoad":{"name":"runAtLoad","type":"\u0004","is_mandatory":true,"title":"Whether this job runs at load","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sockets":{"name":"sockets","type":"\n","is_mandatory":true,"title":"Socket configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Source: \"system\", \"library\", or \"user\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"startCalendarInterval":{"name":"startCalendarInterval","type":"\u0019\n","is_mandatory":true,"title":"Calendar-based schedule","provider":"go.mondoo.com/cnquery/v9/providers/os"},"startInterval":{"name":"startInterval","type":"\u0005","is_mandatory":true,"title":"Interval between runs (seconds)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stderrPath":{"name":"stderrPath","type":"\u0007","is_mandatory":true,"title":"Path to redirect stderr","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stdoutPath":{"name":"stdoutPath","type":"\u0007","is_mandatory":true,"title":"Path to redirect stdout","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type: \"daemon\" or \"agent\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"userName":{"name":"userName","type":"\u0007","is_mandatory":true,"title":"User the job runs as","provider":"go.mondoo.com/cnquery/v9/providers/os"},"watchPaths":{"name":"watchPaths","type":"\u0019\u0007","is_mandatory":true,"title":"Watch paths that trigger the job","provider":"go.mondoo.com/cnquery/v9/providers/os"},"workingDirectory":{"name":"workingDirectory","type":"\u0007","is_mandatory":true,"title":"Working directory","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Individual launchd job configuration","private":true,"min_provider_version":"11.8.3","defaults":"label type","provider":"go.mondoo.com/cnquery/v9/providers/os"},"limits":{"id":"limits","name":"limits","fields":{"entries":{"name":"entries","type":"\u0019\u001blimits.entry","refs":["\"files\""],"title":"Parsed limits entries","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entry":{"name":"entry","type":"\u001blimits.entry","title":"Resource limit entry","desc":"Single line from a limits configuration file, giving one domain / type / item / value tuple (e.g. `* hard core 0`).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"files":{"name":"files","type":"\u0019\u001bfile","title":"List of files that make up the limits configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"PAM resource limits configuration (limits.conf)","desc":"Soft and hard caps on processes, open files, memory, and other per-user resources, parsed from /etc/security/limits.conf and every .conf file under /etc/security/limits.d. Iterate `entries` to audit for missing or overly permissive limits (e.g. unrestricted core dumps or nofile).","min_provider_version":"11.6.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"limits.entry":{"id":"limits.entry","name":"limits.entry","fields":{"domain":{"name":"domain","type":"\u0007","is_mandatory":true,"title":"Domain (username, @groupname, *, %)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"File where this entry is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"item":{"name":"item","type":"\u0007","is_mandatory":true,"title":"Resource item (core, nofile, nproc, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Limit type (soft, hard, -)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Limit value","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Resource limit entry","desc":"Single line from a limits configuration file, giving one domain / type / item / value tuple (e.g. `* hard core 0`).","private":true,"min_provider_version":"11.6.0","defaults":"domain item","provider":"go.mondoo.com/cnquery/v9/providers/os"},"logindefs":{"id":"logindefs","name":"logindefs","fields":{"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"Content of the configuration file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","title":"Current configuration file for resource","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"content\""],"title":"Parsed login.defs parameters as a name/value map (e.g. PASS_MAX_DAYS, UMASK, ENCRYPT_METHOD)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"Shadow password suite (login.defs) configuration","desc":"Password aging, UID/GID ranges, and login policy parameters parsed from /etc/login.defs. The params map exposes settings such as PASS_MAX_DAYS, PASS_MIN_DAYS, PASS_WARN_AGE, UMASK, and ENCRYPT_METHOD, which drive account and password-policy audits. Point at an alternate file with the `path` argument.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"logrotate":{"id":"logrotate","name":"logrotate","fields":{"entries":{"name":"entries","type":"\u0019\u001blogrotate.entry","refs":["\"files\""],"title":"Per-file/glob rotation entries","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entry":{"name":"entry","type":"\u001blogrotate.entry","title":"Logrotate configuration entry for a specific log path","desc":"Rotation rule for one log path or glob. `path` is the log the block applies to and `config` holds every directive inside the block as key-value pairs (e.g. \"rotate\", \"daily\", \"compress\", \"maxage\"). `file` and `lineNumber` locate the block in its source configuration file.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"files":{"name":"files","type":"\u0019\u001bfile","title":"List of configuration files (main + logrotate.d fragments)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"globalConfig":{"name":"globalConfig","type":"\u001a\u0007\u0007","refs":["\"files\""],"title":"Global directives (outside any file block)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"logrotate configuration","desc":"Log rotation configuration parsed from the main logrotate.conf and the fragments under logrotate.d. `globalConfig` holds the directives that apply outside any log block, `entries` holds the per-log-path rotation rules, and `files` lists the configuration files read. Audit rotation frequency, retention counts, and compression to confirm logs are kept long enough and pruned safely.","min_provider_version":"11.8.14","provider":"go.mondoo.com/cnquery/v9/providers/os"},"logrotate.entry":{"id":"logrotate.entry","name":"logrotate.entry","fields":{"config":{"name":"config","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives in this block as key-value pairs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"Configuration file where this entry is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the configuration file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Log file path or glob pattern","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Logrotate configuration entry for a specific log path","desc":"Rotation rule for one log path or glob. `path` is the log the block applies to and `config` holds every directive inside the block as key-value pairs (e.g. \"rotate\", \"daily\", \"compress\", \"maxage\"). `file` and `lineNumber` locate the block in its source configuration file.","private":true,"min_provider_version":"11.8.14","defaults":"path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lsblk":{"id":"lsblk","name":"lsblk","fields":{"entry":{"name":"entry","type":"\u001blsblk.entry","title":"Unix block device","desc":"Single block device reported by `lsblk`: its device `name`, filesystem type (`fstype`), `label`, UUID, and `mountpoints` list. Filter to audit disk layout and mount configuration, e.g. `lsblk.where(mountpoints.contains(\"/\"))`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"list":{"name":"list","type":"\u0019\u001blsblk.entry","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001blsblk.entry","title":"Unix block devices (lsblk)","desc":"Block devices reported by `lsblk`, each carrying its device name, filesystem type, label, UUID, and mount points. Iterate to audit disk layout, filesystem labels, and mount configuration.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lsblk.entry":{"id":"lsblk.entry","name":"lsblk.entry","fields":{"fstype":{"name":"fstype","type":"\u0007","is_mandatory":true,"title":"File system type","provider":"go.mondoo.com/cnquery/v9/providers/os"},"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"Label for the file system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mountpoints":{"name":"mountpoints","type":"\u0019\u0007","is_mandatory":true,"title":"Mount points for the device","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Device name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uuid":{"name":"uuid","type":"\u0007","is_mandatory":true,"title":"UUID for the file system","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Unix block device","desc":"Single block device reported by `lsblk`: its device `name`, filesystem type (`fstype`), `label`, UUID, and `mountpoints` list. Filter to audit disk layout and mount configuration, e.g. `lsblk.where(mountpoints.contains(\"/\"))`.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lua":{"id":"lua","fields":{"package":{"name":"package","type":"\u001blua.package","title":"Lua package","desc":"Single installed LuaRocks rock with its `name`, `version`, and a `purl` (Package URL) for SBOM and vulnerability matching, plus the `files` that declared it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001blua.packages","title":"Lua/LuaRocks package inventory","desc":"Installed LuaRocks rocks with their versions, gathered from the LuaRocks rock trees (`/usr/local/lib/luarocks/rocks-*`, `/usr/share/lua/*`) or `luarocks list`. Pass `path` to search a specific rock tree. Each entry carries a `purl` for SBOM and vulnerability matching.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"lua.package":{"id":"lua.package","name":"lua.package","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files that declared the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Package name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl) identifying the package for SBOM and vulnerability matching","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Lua package","desc":"Single installed LuaRocks rock with its `name`, `version`, and a `purl` (Package URL) for SBOM and vulnerability matching, plus the `files` that declared it.","private":true,"min_provider_version":"13.15.2","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lua.packages":{"id":"lua.packages","name":"lua.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to build the package list","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001blua.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Filesystem path searched for installed LuaRocks rocks (empty scans the default rock trees)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001blua.package","title":"Lua/LuaRocks package inventory","desc":"Installed LuaRocks rocks with their versions, gathered from the LuaRocks rock trees (`/usr/local/lib/luarocks/rocks-*`, `/usr/share/lua/*`) or `luarocks list`. Pass `path` to search a specific rock tree. Each entry carries a `purl` for SBOM and vulnerability matching.","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"luks":{"id":"luks","name":"luks","fields":{"keyslot":{"name":"keyslot","type":"\u001bluks.keyslot","title":"LUKS keyslot","desc":"One keyslot in a LUKS header: its index, state, and the key-derivation parameters used to wrap the master key. Audit for weak KDFs, low iteration or memory costs, and unexpectedly large numbers of active slots (each active slot is a passphrase that can unlock the volume).","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"volume":{"name":"volume","type":"\u001bluks.volume","title":"LUKS-encrypted block device","desc":"Single LUKS-formatted block device: its header version, label, master-key size and offset, cipher, and keyslots. Select a volume by its `uuid` (e.g., `luks.volumes.where(uuid == \"fd44f17a-...\")`) or by the underlying block device's `name`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"volumes":{"name":"volumes","type":"\u0019\u001bluks.volume","title":"LUKS-formatted block devices on the host","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"LUKS-encrypted volumes on the host","desc":"Block devices that carry a LUKS header, exposing each volume's on-disk format version, cipher, key-derivation parameters, and every keyslot. Both LUKS1 and LUKS2 headers are reported through the same schema; the `version` field on each volume distinguishes them and version-specific fields (label, subsystem, and tokens for LUKS2; AF-splitter stripes for LUKS1) are populated only where they apply.","min_provider_version":"13.17.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"luks.keyslot":{"id":"luks.keyslot","name":"luks.keyslot","fields":{"hash":{"name":"hash","type":"\u0007","is_mandatory":true,"title":"Hash used by the KDF (pbkdf2 only; e.g., sha256, sha512)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"index":{"name":"index","type":"\u0005","is_mandatory":true,"title":"Slot index (0–7 on LUKS1, 0–31 on LUKS2)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"iterations":{"name":"iterations","type":"\u0005","is_mandatory":true,"title":"PBKDF2 iteration count (pbkdf2 only)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"kdf":{"name":"kdf","type":"\u0007","is_mandatory":true,"title":"KDF used for this slot","desc":"One of pbkdf2, argon2i, or argon2id.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"keyMaterialOffset":{"name":"keyMaterialOffset","type":"\u0005","is_mandatory":true,"title":"Key-material offset in 512-byte sectors","provider":"go.mondoo.com/cnquery/v9/providers/os"},"memory":{"name":"memory","type":"\u0005","is_mandatory":true,"title":"argon2 memory cost in KiB (argon2* only)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parallel":{"name":"parallel","type":"\u0005","is_mandatory":true,"title":"argon2 parallelism (argon2* only)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Slot state","desc":"ENABLED or DISABLED on LUKS1; active or inactive on LUKS2.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stripes":{"name":"stripes","type":"\u0005","is_mandatory":true,"title":"AF-splitter stripe count (LUKS1 only)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"time":{"name":"time","type":"\u0005","is_mandatory":true,"title":"argon2 time cost (argon2* only)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"LUKS keyslot","desc":"One keyslot in a LUKS header: its index, state, and the key-derivation parameters used to wrap the master key. Audit for weak KDFs, low iteration or memory costs, and unexpectedly large numbers of active slots (each active slot is a passphrase that can unlock the volume).","min_provider_version":"13.17.1","defaults":"index state kdf","provider":"go.mondoo.com/cnquery/v9/providers/os"},"luks.volume":{"id":"luks.volume","name":"luks.volume","fields":{"blockDevice":{"name":"blockDevice","type":"\u001blsblk.entry","title":"Underlying lsblk block device","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cipher":{"name":"cipher","type":"\u001bluks.volume.cipher","title":"Cipher protecting the master key","provider":"go.mondoo.com/cnquery/v9/providers/os"},"keyslots":{"name":"keyslots","type":"\u0019\u001bluks.keyslot","title":"Keyslots defined in the header","provider":"go.mondoo.com/cnquery/v9/providers/os"},"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"Label assigned in the LUKS2 header (empty on LUKS1)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"masterKeyBits":{"name":"masterKeyBits","type":"\u0005","is_mandatory":true,"title":"Master-key size in bits","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Path of the underlying block device (e.g., /dev/sda3)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"payloadOffset":{"name":"payloadOffset","type":"\u0005","is_mandatory":true,"title":"Payload offset in 512-byte sectors","provider":"go.mondoo.com/cnquery/v9/providers/os"},"subsystem":{"name":"subsystem","type":"\u0007","is_mandatory":true,"title":"Subsystem string from the LUKS2 header (empty on LUKS1)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tokens":{"name":"tokens","type":"\u0019\n","is_mandatory":true,"title":"LUKS2 tokens attached to the header (empty on LUKS1)","desc":"Each entry carries the token id, type (e.g., luks2-keyring, systemd-tpm2, systemd-fido2, systemd-pkcs11), the keyslot indices the token unlocks, and any token-type-specific metadata.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uuid":{"name":"uuid","type":"\u0007","is_mandatory":true,"title":"LUKS header UUID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"LUKS header version (1 or 2)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"LUKS-encrypted block device","desc":"Single LUKS-formatted block device: its header version, label, master-key size and offset, cipher, and keyslots. Select a volume by its `uuid` (e.g., `luks.volumes.where(uuid == \"fd44f17a-...\")`) or by the underlying block device's `name`.","min_provider_version":"13.17.1","defaults":"name uuid version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"luks.volume.cipher":{"id":"luks.volume.cipher","name":"luks.volume.cipher","fields":{"hash":{"name":"hash","type":"\u0007","is_mandatory":true,"title":"Hash used by the AF splitter (LUKS1) or sector integrity (LUKS2)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"keySize":{"name":"keySize","type":"\u0005","is_mandatory":true,"title":"Master-key size in bits","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Cipher mode (e.g., xts-plain64, cbc-essiv:sha256)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cipher family (e.g., aes, serpent, twofish)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"spec":{"name":"spec","type":"\u0007","is_mandatory":true,"title":"Combined cipher spec as cryptsetup reports it","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"LUKS cipher specification","desc":"Symmetric cipher protecting a LUKS volume's master key. `name` is the cipher family, `mode` is the chaining mode, and `spec` is the combined cryptsetup string (e.g., `aes-xts-plain64`). On LUKS1, `hash` carries the AF-splitter hash; on LUKS2 it is the integrity hash when sector integrity is configured.","private":true,"min_provider_version":"13.17.1","defaults":"spec keySize","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lvm":{"id":"lvm","name":"lvm","fields":{"logicalVolume":{"name":"logicalVolume","type":"\u001blvm.logicalVolume","title":"LVM logical volume","desc":"Single LVM logical volume: `name`, full device `path`, `uuid`, parent volume group (`volumeGroupName`), attribute flags, size in bytes, snapshot `origin`, and thin-pool data usage. For thin volumes, `poolName` is set; for snapshots, `origin` is the source LV name.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"logicalVolumes":{"name":"logicalVolumes","type":"\u0019\u001blvm.logicalVolume","title":"Logical volumes across all volume groups","provider":"go.mondoo.com/cnquery/v9/providers/os"},"physicalVolume":{"name":"physicalVolume","type":"\u001blvm.physicalVolume","title":"LVM physical volume","desc":"Single block device initialized as an LVM physical volume: device path (`name`), `uuid`, the volume group it belongs to (`volumeGroupName`, empty if unassigned), on-disk `format`, attribute flags, and total/free byte counts.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"physicalVolumes":{"name":"physicalVolumes","type":"\u0019\u001blvm.physicalVolume","title":"Physical volumes initialized for LVM","provider":"go.mondoo.com/cnquery/v9/providers/os"},"volumeGroup":{"name":"volumeGroup","type":"\u001blvm.volumeGroup","title":"LVM volume group","desc":"Single LVM volume group: `name`, `uuid`, attribute flags, total and free byte counts, and the counts of physical volumes, logical volumes, and snapshots it contains. Useful for auditing capacity headroom and group-level policy.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"volumeGroups":{"name":"volumeGroups","type":"\u0019\u001blvm.volumeGroup","title":"Volume groups","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Linux Logical Volume Manager","desc":"LVM block-device storage on Linux: physical volumes initialized for LVM, volume groups that aggregate them, and the logical volumes carved out of those groups. Iterate `physicalVolumes`, `volumeGroups`, and `logicalVolumes` to audit LVM layout, free capacity, thin-pool usage, and snapshot relationships.","min_provider_version":"13.16.10","defaults":"volumeGroups","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lvm.logicalVolume":{"id":"lvm.logicalVolume","name":"lvm.logicalVolume","fields":{"attributes":{"name":"attributes","type":"\u0007","is_mandatory":true,"title":"LV attribute flags","desc":"Ten-character status string covering volume type, permissions, allocation policy, fixed minor, state, open device, target type, zeroing, and skipped activation. See lvm(8) `lv_attr` for the full set.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dataPercent":{"name":"dataPercent","type":"\u0006","title":"Data percentage used (for thin pools, thin volumes, snapshots, mirrors); null if not applicable","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Logical volume name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"origin":{"name":"origin","type":"\u0007","is_mandatory":true,"title":"Origin LV name for snapshots, empty if not a snapshot","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Full device path (e.g., /dev/vg0/data)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"poolName":{"name":"poolName","type":"\u0007","is_mandatory":true,"title":"Pool name for thin volumes, empty if not a thin volume","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sizeBytes":{"name":"sizeBytes","type":"\u0005","is_mandatory":true,"title":"Size in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uuid":{"name":"uuid","type":"\u0007","is_mandatory":true,"title":"UUID of the logical volume","provider":"go.mondoo.com/cnquery/v9/providers/os"},"volumeGroupName":{"name":"volumeGroupName","type":"\u0007","is_mandatory":true,"title":"Name of the volume group this LV belongs to","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"LVM logical volume","desc":"Single LVM logical volume: `name`, full device `path`, `uuid`, parent volume group (`volumeGroupName`), attribute flags, size in bytes, snapshot `origin`, and thin-pool data usage. For thin volumes, `poolName` is set; for snapshots, `origin` is the source LV name.","private":true,"min_provider_version":"13.16.10","defaults":"name volumeGroupName sizeBytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lvm.physicalVolume":{"id":"lvm.physicalVolume","name":"lvm.physicalVolume","fields":{"attributes":{"name":"attributes","type":"\u0007","is_mandatory":true,"title":"PV attribute flags","desc":"Three-character status string. Common values include `a` (allocatable), `x` (exported), and `m` (missing). See lvm(8) `pv_attr` for the full set.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"format":{"name":"format","type":"\u0007","is_mandatory":true,"title":"PV on-disk format (typically \"lvm2\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"freeBytes":{"name":"freeBytes","type":"\u0005","is_mandatory":true,"title":"Free space in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Physical volume device path (e.g., /dev/sda1)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sizeBytes":{"name":"sizeBytes","type":"\u0005","is_mandatory":true,"title":"Total size in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uuid":{"name":"uuid","type":"\u0007","is_mandatory":true,"title":"UUID of the physical volume","provider":"go.mondoo.com/cnquery/v9/providers/os"},"volumeGroupName":{"name":"volumeGroupName","type":"\u0007","is_mandatory":true,"title":"Name of the volume group this PV belongs to (empty if unassigned)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"LVM physical volume","desc":"Single block device initialized as an LVM physical volume: device path (`name`), `uuid`, the volume group it belongs to (`volumeGroupName`, empty if unassigned), on-disk `format`, attribute flags, and total/free byte counts.","private":true,"min_provider_version":"13.16.10","defaults":"name volumeGroupName sizeBytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lvm.volumeGroup":{"id":"lvm.volumeGroup","name":"lvm.volumeGroup","fields":{"attributes":{"name":"attributes","type":"\u0007","is_mandatory":true,"title":"VG attribute flags","desc":"Six-character status string covering permissions, resizability, export state, partial state, allocation policy, and clustering. See lvm(8) `vg_attr` for the full set.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"freeBytes":{"name":"freeBytes","type":"\u0005","is_mandatory":true,"title":"Free space in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"logicalVolumeCount":{"name":"logicalVolumeCount","type":"\u0005","is_mandatory":true,"title":"Number of logical volumes in this group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Volume group name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"physicalVolumeCount":{"name":"physicalVolumeCount","type":"\u0005","is_mandatory":true,"title":"Number of physical volumes in this group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sizeBytes":{"name":"sizeBytes","type":"\u0005","is_mandatory":true,"title":"Total size in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"snapshotCount":{"name":"snapshotCount","type":"\u0005","is_mandatory":true,"title":"Number of snapshots in this group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uuid":{"name":"uuid","type":"\u0007","is_mandatory":true,"title":"UUID of the volume group","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"LVM volume group","desc":"Single LVM volume group: `name`, `uuid`, attribute flags, total and free byte counts, and the counts of physical volumes, logical volumes, and snapshots it contains. Useful for auditing capacity headroom and group-level policy.","private":true,"min_provider_version":"13.16.10","defaults":"name sizeBytes freeBytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"machine":{"id":"machine","name":"machine","fields":{"baseboard":{"name":"baseboard","type":"\u001bmachine.baseboard","title":"SMBIOS baseboard (or module) information","desc":"Baseboard manufacturer, product name, version, serial number, and asset tag as reported in SMBIOS Type 2 tables. Used for hardware inventory and to correlate physical boards with asset-tracking systems.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"bios":{"name":"bios","type":"\u001bmachine.bios","title":"SMBIOS BIOS information","desc":"Firmware vendor, version string, and release date as reported by SMBIOS Type 0 tables. Used to inventory BIOS versions across a fleet and to flag hosts that have not applied vendor firmware updates.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"chassis":{"name":"chassis","type":"\u001bmachine.chassis","title":"SMBIOS system enclosure or chassis","desc":"Chassis manufacturer, version, serial number, and asset tag as reported in SMBIOS Type 3 tables. Useful for physical-hardware audits and correlating enclosures with asset-tracking records.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"cpu":{"name":"cpu","type":"\u001bmachine.cpu","title":"CPU information","desc":"CPU manufacturer, model name, number of physical processor packages (sockets), and total physical core count as reported by the system. Used for capacity planning, licensing audits, and hardware-baseline policies.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"secureboot":{"name":"secureboot","type":"\u001bmachine.secureboot","title":"Secure Boot status","desc":"EFI Secure Boot posture: whether the system booted in EFI/UEFI mode (`efi`), whether Secure Boot is currently enabled (`enabled`), and whether it is in setup mode (`setupMode`, meaning keys can be modified without authentication). Read from EFI variables on Linux and from the UEFI firmware on Windows; legacy-BIOS systems resolve to `efi` and `enabled` false rather than erroring. Used to assert that Secure Boot is enforced and that setup mode is not active.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"system":{"name":"system","type":"\u001bmachine.system","title":"SMBIOS system information","desc":"Manufacturer, product name, version, serial number, UUID, SKU number, and family string as reported in SMBIOS Type 1 tables. Useful for asset inventory, warranty lookups, and supply-chain reviews.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"title":"Hardware identity from SMBIOS / DMI","desc":"Namespace for low-level hardware identity exposed by the firmware. The sub-resources below (`machine.bios`, `machine.system`, `machine.baseboard`, `machine.chassis`, `machine.cpu`, and `machine.secureboot`) surface the SMBIOS / DMI tables (vendor, version, and release date for the BIOS; manufacturer, product, SKU, UUID, and serial for the system; baseboard and chassis identifiers; CPU socket and core counts) plus the EFI Secure Boot posture read from EFI variables on Linux. Used for inventory, warranty and supply-chain reviews, and platform-firmware compliance.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"machine.baseboard":{"id":"machine.baseboard","name":"machine.baseboard","fields":{"assetTag":{"name":"assetTag","type":"\u0007","is_mandatory":true,"title":"Asset tag","provider":"go.mondoo.com/cnquery/v9/providers/os"},"manufacturer":{"name":"manufacturer","type":"\u0007","is_mandatory":true,"title":"Baseboard manufacturer name (SMBIOS Type 2)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"product":{"name":"product","type":"\u0007","is_mandatory":true,"title":"Baseboard product name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serial":{"name":"serial","type":"\u0007","is_mandatory":true,"title":"Baseboard serial number","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Baseboard version string","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"SMBIOS baseboard (or module) information","desc":"Baseboard manufacturer, product name, version, serial number, and asset tag as reported in SMBIOS Type 2 tables. Used for hardware inventory and to correlate physical boards with asset-tracking systems.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"machine.bios":{"id":"machine.bios","name":"machine.bios","fields":{"releaseDate":{"name":"releaseDate","type":"\u0007","is_mandatory":true,"title":"BIOS release date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vendor":{"name":"vendor","type":"\u0007","is_mandatory":true,"title":"BIOS vendor","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"BIOS version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"SMBIOS BIOS information","desc":"Firmware vendor, version string, and release date as reported by SMBIOS Type 0 tables. Used to inventory BIOS versions across a fleet and to flag hosts that have not applied vendor firmware updates.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"machine.chassis":{"id":"machine.chassis","name":"machine.chassis","fields":{"assetTag":{"name":"assetTag","type":"\u0007","is_mandatory":true,"title":"Asset tag number","provider":"go.mondoo.com/cnquery/v9/providers/os"},"manufacturer":{"name":"manufacturer","type":"\u0007","is_mandatory":true,"title":"Manufacturer","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serial":{"name":"serial","type":"\u0007","is_mandatory":true,"title":"Serial number","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"SMBIOS system enclosure or chassis","desc":"Chassis manufacturer, version, serial number, and asset tag as reported in SMBIOS Type 3 tables. Useful for physical-hardware audits and correlating enclosures with asset-tracking records.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"machine.cpu":{"id":"machine.cpu","name":"machine.cpu","fields":{"coreCount":{"name":"coreCount","type":"\u0005","is_mandatory":true,"title":"Total number of physical CPU cores","provider":"go.mondoo.com/cnquery/v9/providers/os"},"manufacturer":{"name":"manufacturer","type":"\u0007","is_mandatory":true,"title":"CPU manufacturer","provider":"go.mondoo.com/cnquery/v9/providers/os"},"model":{"name":"model","type":"\u0007","is_mandatory":true,"title":"CPU model name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"processorCount":{"name":"processorCount","type":"\u0005","is_mandatory":true,"title":"Number of physical CPU packages (sockets)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"CPU information","desc":"CPU manufacturer, model name, number of physical processor packages (sockets), and total physical core count as reported by the system. Used for capacity planning, licensing audits, and hardware-baseline policies.","min_provider_version":"13.2.3","defaults":"manufacturer model processorCount coreCount","provider":"go.mondoo.com/cnquery/v9/providers/os"},"machine.secureboot":{"id":"machine.secureboot","name":"machine.secureboot","fields":{"efi":{"name":"efi","type":"\u0004","title":"Whether the system is booted in EFI/UEFI mode","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","title":"Whether Secure Boot is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"setupMode":{"name":"setupMode","type":"\u0004","title":"Whether Secure Boot is in setup mode (keys can be modified without authentication)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Secure Boot status","desc":"EFI Secure Boot posture: whether the system booted in EFI/UEFI mode (`efi`), whether Secure Boot is currently enabled (`enabled`), and whether it is in setup mode (`setupMode`, meaning keys can be modified without authentication). Read from EFI variables on Linux and from the UEFI firmware on Windows; legacy-BIOS systems resolve to `efi` and `enabled` false rather than erroring. Used to assert that Secure Boot is enforced and that setup mode is not active.","min_provider_version":"13.6.2","defaults":"enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"machine.system":{"id":"machine.system","name":"machine.system","fields":{"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"System family/series","provider":"go.mondoo.com/cnquery/v9/providers/os"},"manufacturer":{"name":"manufacturer","type":"\u0007","is_mandatory":true,"title":"System manufacturer name (SMBIOS Type 1)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"product":{"name":"product","type":"\u0007","is_mandatory":true,"title":"System product name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serial":{"name":"serial","type":"\u0007","is_mandatory":true,"title":"System serial number","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sku":{"name":"sku","type":"\u0007","is_mandatory":true,"title":"SKU number","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uuid":{"name":"uuid","type":"\u0007","is_mandatory":true,"title":"System UUID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"System version string","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"SMBIOS system information","desc":"Manufacturer, product name, version, serial number, UUID, SKU number, and family string as reported in SMBIOS Type 1 tables. Useful for asset inventory, warranty lookups, and supply-chain reviews.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos":{"id":"macos","name":"macos","fields":{"alf":{"name":"alf","type":"\u001bmacos.alf","title":"macOS application layer firewall (raw ALF preference values)","desc":"Raw integer flags read from the Application Layer Firewall plist (`/Library/Preferences/com.apple.alf.plist`). Prefer `macos.firewall`, which decodes these into boolean fields; use this resource only when you need the underlying preference values.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"computerName":{"name":"computerName","type":"\u0007","title":"macOS computer name","min_provider_version":"11.4.68","provider":"go.mondoo.com/cnquery/v9/providers/os"},"filevault":{"name":"filevault","type":"\u001bmacos.filevault","title":"macOS FileVault full-disk encryption","desc":"FileVault full-disk encryption state: whether it is `enabled`, the current `status`, whether personal and institutional recovery keys exist, and the `users` permitted to unlock the encrypted volume at boot. CIS macOS benchmarks require FileVault enabled.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"firewall":{"name":"firewall","type":"\u001bmacos.firewall","title":"macOS application layer firewall","desc":"Decoded Application Layer Firewall configuration: whether the firewall is `enabled`, whether it blocks all incoming connections, stealth mode, logging, the signed-app auto-allow policy, and per-application rules. CIS macOS benchmarks expect the firewall enabled with stealth mode on. See `macos.alf` for the raw preference values.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"gatekeeper":{"name":"gatekeeper","type":"\u001bmacos.gatekeeper","title":"macOS Gatekeeper application execution policy","desc":"Gatekeeper policy that controls whether downloaded applications may run: whether assessments are `enabled` and the human-readable `status`. Disabling Gatekeeper lets unsigned or unnotarized software launch without a warning, so benchmarks expect it enabled.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"globalAccountPolicies":{"name":"globalAccountPolicies","type":"\n","title":"Global account (password) policy directives applied to all local users","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hardware":{"name":"hardware","type":"\u001bmacos.hardware","title":"macOS hardware overview","desc":"Hardware and firmware details reported by `system_profiler`: chip type, model identifiers, installed memory, serial number, and Activation Lock status. Useful for asset inventory and for distinguishing Apple Silicon from Intel Macs in conditional audits.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"mdm":{"name":"mdm","type":"\u001bmacos.mdm","title":"macOS MDM (Mobile Device Management) enrollment state","desc":"MDM enrollment state for this Mac: whether it is enrolled, the enrollment server, and whether enrollment was performed via Automated Device Enrollment (formerly DEP) or user-approved. Use `macos.profiles` to enumerate the configuration profiles delivered to the device. Backed by `profiles status -type enrollment`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"profile":{"name":"profile","type":"\u001bmacos.profile","title":"macOS Configuration Profile","desc":"Single Configuration Profile: its `identifier`, `uuid`, human-readable `displayName`, `description`, `organization`, `type`, whether it is install-locked (`removalDisallowed`), the scope it applies to (`scope`: `system` or `user`), and the individual `payloads` that carry the actual policy directives.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"profiles":{"name":"profiles","type":"\u001bmacos.profiles","title":"macOS configuration profiles installed on the system","desc":"Every Configuration Profile delivered to the device, both MDM-delivered and manually installed `.mobileconfig` payloads, so you can audit what policies are actually in force. Backed by `profiles list -all -output stdout-xml`; requires root to see system-level (`_computerlevel`) profiles, otherwise only the current user's profiles are returned.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"sharing":{"name":"sharing","type":"\u001bmacos.sharing","title":"macOS Sharing service state","desc":"State of each toggle in the unified Sharing panel (System Settings \u003e Sharing on macOS Ventura+, System Preferences \u003e Sharing on older versions). CIS macOS benchmarks require most of these off unless the device explicitly needs the service. Backed by `system_profiler SPSharingDataType`, so the values match exactly what the System Settings UI displays.  `system_profiler SPSharingDataType` also reports `Remote Login` and `Remote Apple Events`; those are intentionally not exposed here because `macos.systemsetup.remoteLogin` and `macos.systemsetup.remoteAppleEvents` already cover them via the `systemsetup` CLI. This resource covers the rest of the panel.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"sip":{"name":"sip","type":"\u001bmacos.sip","title":"macOS System Integrity Protection (SIP)","desc":"System Integrity Protection state, the kernel-level protection that restricts modification of protected system files and processes even by root. Exposes whether SIP is `enabled` and the raw `status` message from `csrutil status`. Disabling SIP is a significant hardening regression.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"softwareupdate":{"name":"softwareupdate","type":"\u001bmacos.softwareupdate","title":"macOS Software Update configuration and pending updates","desc":"Automatic-update policy and the list of updates currently available to install. Policy fields read from `/Library/Preferences/com.apple.SoftwareUpdate.plist` (with `/Library/Managed Preferences/` taking precedence when an MDM configuration profile has been delivered). The `updates` list is produced from `softwareupdate -l --no-scan` so it does not initiate a network check.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"systemExtension":{"name":"systemExtension","type":"\u001bmacos.systemExtension","title":"macOS system extension","desc":"Installed system extension read from /Library/SystemExtensions/db.plist: its `identifier`, `uuid`, `version`, `teamID` of the signing developer, declared `categories` (such as network or endpoint-security extensions), and `bundlePath`. The `state` string reports the extension's lifecycle, with `enabled` and `active` derived from it. `mdmManaged` is true when the extension or its team is allowlisted by an MDM system-extension policy, which distinguishes centrally approved extensions from user-installed ones.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"systemExtensions":{"name":"systemExtensions","type":"\u0019\u001bmacos.systemExtension","title":"Installed system extensions (network, endpoint security, and driver extensions)","min_provider_version":"11.2.20","provider":"go.mondoo.com/cnquery/v9/providers/os"},"systemsetup":{"name":"systemsetup","type":"\u001bmacos.systemsetup","title":"macOS machine settings via the systemsetup CLI","desc":"Date/time, sleep and wake, remote login, power, and network-time settings surfaced by the `systemsetup` CLI, with each field mapping to one `systemsetup -get*` query. Requires at least admin privileges to run.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"timemachine":{"name":"timemachine","type":"\u001bmacos.timemachine","title":"macOS Time Machine backup configuration","desc":"Time Machine backup configuration read from its preferences: configured backup destinations, the automatic backup schedule, and the paths excluded from backups, exposed as the raw `preferences` dict.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"userHostPreferences":{"name":"userHostPreferences","type":"\u001a\u0007\n","title":"Per-user, per-host macOS defaults (ByHost preferences), keyed by preference domain","provider":"go.mondoo.com/cnquery/v9/providers/os"},"userPreferences":{"name":"userPreferences","type":"\u001a\u0007\n","title":"Per-user macOS defaults (preferences), keyed by preference domain","provider":"go.mondoo.com/cnquery/v9/providers/os"},"xprotect":{"name":"xprotect","type":"\u001bmacos.xprotect","title":"macOS XProtect anti-malware bundle","desc":"Version and last-modified timestamp of the XProtect signature bundle (and, when present, the legacy Malware Removal Tool). CIS macOS benchmarks expect XProtect signatures to be current; checking `modified` against the auditor's freshness threshold catches devices that have stopped receiving updates.  XProtect.bundle lives at `/Library/Apple/System/Library/CoreServices/XProtect.bundle` on modern macOS (with `/System/Library/CoreServices/XProtect.bundle` as the legacy fallback). `mrtVersion` and `mrtModified` are empty or null on macOS 13+ where MRT has been retired in favor of XProtectRemediator.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"title":"macOS-specific operating system surfaces","desc":"macOS host settings not covered by the cross-platform resources: the machine's `computerName`, per-user and per-host defaults (preferences), the global account/password policy, and installed `systemExtensions`. A starting point for macOS-specific audits alongside the dedicated resources such as firewall, filevault, gatekeeper, and sip.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.alf":{"id":"macos.alf","name":"macos.alf","fields":{"allowDownloadSignedEnabled":{"name":"allowDownloadSignedEnabled","type":"\u0005","is_mandatory":true,"title":"Whether the firewall service allows downloaded software to receive incoming connections","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowSignedEnabled":{"name":"allowSignedEnabled","type":"\u0005","is_mandatory":true,"title":"Whether the firewall service allows built-in software to receive incoming connections for signed software","provider":"go.mondoo.com/cnquery/v9/providers/os"},"applications":{"name":"applications","type":"\u0019\n","is_mandatory":true,"title":"Applications with configured incoming-connection exceptions","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exceptions":{"name":"exceptions","type":"\u0019\n","is_mandatory":true,"title":"Per-service firewall exceptions","provider":"go.mondoo.com/cnquery/v9/providers/os"},"explicitAuths":{"name":"explicitAuths","type":"\u0019\u0007","is_mandatory":true,"title":"Services explicitly allowed to perform networking","provider":"go.mondoo.com/cnquery/v9/providers/os"},"firewallUnload":{"name":"firewallUnload","type":"\u0005","is_mandatory":true,"title":"Whether the firewall is unloaded","provider":"go.mondoo.com/cnquery/v9/providers/os"},"globalState":{"name":"globalState","type":"\u0005","is_mandatory":true,"title":"Global firewall state (0=off, 1=on for specific services, 2=block all incoming connections)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"loggingEnabled":{"name":"loggingEnabled","type":"\u0005","is_mandatory":true,"title":"Whether alf.log is used","provider":"go.mondoo.com/cnquery/v9/providers/os"},"loggingOption":{"name":"loggingOption","type":"\u0005","is_mandatory":true,"title":"Logging option flags (0=disabled, 1=detail, 2=brief, 3=throttled)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stealthEnabled":{"name":"stealthEnabled","type":"\u0005","is_mandatory":true,"title":"Whether the firewall service is in stealth mode","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"ALF version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS application layer firewall (raw ALF preference values)","desc":"Raw integer flags read from the Application Layer Firewall plist (`/Library/Preferences/com.apple.alf.plist`). Prefer `macos.firewall`, which decodes these into boolean fields; use this resource only when you need the underlying preference values.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.filevault":{"id":"macos.filevault","name":"macos.filevault","fields":{"enabled":{"name":"enabled","type":"\u0004","title":"Whether FileVault is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hasInstitutionalRecoveryKey":{"name":"hasInstitutionalRecoveryKey","type":"\u0004","title":"Whether an institutional recovery key exists","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hasPersonalRecoveryKey":{"name":"hasPersonalRecoveryKey","type":"\u0004","title":"Whether a personal recovery key exists","provider":"go.mondoo.com/cnquery/v9/providers/os"},"status":{"name":"status","type":"\u0007","title":"FileVault status (On, Off, Encryption in progress, Decryption in progress)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"users":{"name":"users","type":"\u0019\u0007","title":"Users authorized to unlock the FileVault-encrypted startup disk at boot","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS FileVault full-disk encryption","desc":"FileVault full-disk encryption state: whether it is `enabled`, the current `status`, whether personal and institutional recovery keys exist, and the `users` permitted to unlock the encrypted volume at boot. CIS macOS benchmarks require FileVault enabled.","min_provider_version":"13.5.1","defaults":"enabled status","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.firewall":{"id":"macos.firewall","name":"macos.firewall","fields":{"allowDownloadSignedApps":{"name":"allowDownloadSignedApps","type":"\u0004","title":"Whether downloaded signed applications are automatically allowed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowSignedApps":{"name":"allowSignedApps","type":"\u0004","title":"Whether signed applications are automatically allowed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"app":{"name":"app","type":"\u001bmacos.firewall.app","title":"macOS firewall per-application rule","desc":"Incoming-connection rule for one application: its `name` (the application path), `bundleId`, and `state` (0 blocks incoming connections, 1 allows them).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"applications":{"name":"applications","type":"\u0019\u001bmacos.firewall.app","title":"Applications with explicit firewall rules","provider":"go.mondoo.com/cnquery/v9/providers/os"},"blockAllIncoming":{"name":"blockAllIncoming","type":"\u0004","title":"Whether block-all-incoming mode is active (globalState == 2)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","title":"Whether the firewall is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exceptions":{"name":"exceptions","type":"\u0019\n","title":"Per-service firewall exceptions","provider":"go.mondoo.com/cnquery/v9/providers/os"},"explicitAuths":{"name":"explicitAuths","type":"\u0019\u0007","title":"Services explicitly allowed to perform networking","provider":"go.mondoo.com/cnquery/v9/providers/os"},"loggingDetail":{"name":"loggingDetail","type":"\u0007","title":"Logging detail level: disabled (0), detail (1), brief (2), throttled (3)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"loggingEnabled":{"name":"loggingEnabled","type":"\u0004","title":"Whether logging is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"managedByMDM":{"name":"managedByMDM","type":"\u0004","title":"Whether an installed Configuration Profile manages the firewall","desc":"True when any installed profile carries a payload of type `com.apple.security.firewall`. Enumerating Configuration Profiles requires root, so on an unprivileged session the field surfaces the underlying `profiles list` error rather than silently returning `false`.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stealthEnabled":{"name":"stealthEnabled","type":"\u0004","title":"Whether stealth mode is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"ALF version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS application layer firewall","desc":"Decoded Application Layer Firewall configuration: whether the firewall is `enabled`, whether it blocks all incoming connections, stealth mode, logging, the signed-app auto-allow policy, and per-application rules. CIS macOS benchmarks expect the firewall enabled with stealth mode on. See `macos.alf` for the raw preference values.","min_provider_version":"13.3.1","defaults":"enabled stealthEnabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.firewall.app":{"id":"macos.firewall.app","name":"macos.firewall.app","fields":{"bundleId":{"name":"bundleId","type":"\u0007","is_mandatory":true,"title":"Application bundle identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0005","is_mandatory":true,"title":"Incoming-connection policy (0=block, 1=allow)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS firewall per-application rule","desc":"Incoming-connection rule for one application: its `name` (the application path), `bundleId`, and `state` (0 blocks incoming connections, 1 allows them).","private":true,"min_provider_version":"13.3.1","defaults":"name state","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.gatekeeper":{"id":"macos.gatekeeper","name":"macos.gatekeeper","fields":{"enabled":{"name":"enabled","type":"\u0004","title":"Whether Gatekeeper assessments are enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"status":{"name":"status","type":"\u0007","title":"Gatekeeper assessment status (assessments enabled, assessments disabled)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS Gatekeeper application execution policy","desc":"Gatekeeper policy that controls whether downloaded applications may run: whether assessments are `enabled` and the human-readable `status`. Disabling Gatekeeper lets unsigned or unnotarized software launch without a warning, so benchmarks expect it enabled.","min_provider_version":"13.5.1","defaults":"enabled status","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.hardware":{"id":"macos.hardware","name":"macos.hardware","fields":{"activationLockStatus":{"name":"activationLockStatus","type":"\u0007","is_mandatory":true,"title":"Activation Lock security feature status","provider":"go.mondoo.com/cnquery/v9/providers/os"},"bootRomVersion":{"name":"bootRomVersion","type":"\u0007","is_mandatory":true,"title":"Boot ROM (firmware) version identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chipType":{"name":"chipType","type":"\u0007","is_mandatory":true,"title":"Processor chip type (e.g., \"Apple M1\", \"Apple M2\", \"Intel\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"machineModel":{"name":"machineModel","type":"\u0007","is_mandatory":true,"title":"Specific model identifier (e.g., \"MacBookPro18,3\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"machineName":{"name":"machineName","type":"\u0007","is_mandatory":true,"title":"User-friendly hardware name (e.g., \"MacBook Pro\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modelNumber":{"name":"modelNumber","type":"\u0007","is_mandatory":true,"title":"Apple's model number for the device (e.g., \"A2442\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"numberProcessors":{"name":"numberProcessors","type":"\u0007","is_mandatory":true,"title":"Total number of processor cores","provider":"go.mondoo.com/cnquery/v9/providers/os"},"osLoaderVersion":{"name":"osLoaderVersion","type":"\u0007","is_mandatory":true,"title":"Version of the OS bootloader","provider":"go.mondoo.com/cnquery/v9/providers/os"},"physicalMemory":{"name":"physicalMemory","type":"\u0007","is_mandatory":true,"title":"Total RAM installed (e.g., \"16 GB\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"platformUUID":{"name":"platformUUID","type":"\u0007","is_mandatory":true,"title":"Universally unique identifier for the hardware platform","provider":"go.mondoo.com/cnquery/v9/providers/os"},"provisioningUDID":{"name":"provisioningUDID","type":"\u0007","is_mandatory":true,"title":"Unique Device Identifier for MDM provisioning","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Apple's unique serial number for the device","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS hardware overview","desc":"Hardware and firmware details reported by `system_profiler`: chip type, model identifiers, installed memory, serial number, and Activation Lock status. Useful for asset inventory and for distinguishing Apple Silicon from Intel Macs in conditional audits.","min_provider_version":"11.4.68","defaults":"machineName chipType physicalMemory serialNumber","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.mdm":{"id":"macos.mdm","name":"macos.mdm","fields":{"dep":{"name":"dep","type":"\u0004","title":"Whether the device is enrolled via Automated Device Enrollment (DEP/ADE)","desc":"DEP-enrolled devices are pre-assigned to the organization through Apple Business Manager / Apple School Manager and cannot be removed from MDM by the user.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enrolled":{"name":"enrolled","type":"\u0004","title":"Whether the device is enrolled in an MDM solution","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverUrl":{"name":"serverUrl","type":"\u0007","title":"URL of the MDM server (empty when not enrolled)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"userApproved":{"name":"userApproved","type":"\u0004","title":"Whether the MDM enrollment is user-approved","desc":"User-approved MDM (UAMDM) is required for managing kernel extensions, full disk access, and other privileged settings.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS MDM (Mobile Device Management) enrollment state","desc":"MDM enrollment state for this Mac: whether it is enrolled, the enrollment server, and whether enrollment was performed via Automated Device Enrollment (formerly DEP) or user-approved. Use `macos.profiles` to enumerate the configuration profiles delivered to the device. Backed by `profiles status -type enrollment`.","min_provider_version":"13.16.10","defaults":"enrolled serverUrl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.profile":{"id":"macos.profile","name":"macos.profile","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Profile description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Human-readable profile name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"Reverse-DNS profile identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"organization":{"name":"organization","type":"\u0007","is_mandatory":true,"title":"Distributing organization","provider":"go.mondoo.com/cnquery/v9/providers/os"},"payload":{"name":"payload","type":"\u001bmacos.profile.payload","title":"macOS Configuration Profile payload","desc":"Single payload within a Configuration Profile: the `type` (e.g. `com.apple.security.firewall`, `com.apple.MCXFileVault2`), the payload's reverse-DNS `identifier`, its `uuid`, and the raw policy `content` as a dict. Audit specific policy directives such as firewall payload settings or FileVault policy.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"payloads":{"name":"payloads","type":"\u0019\u001bmacos.profile.payload","is_mandatory":true,"title":"Payloads (policy directives) carried by this profile","provider":"go.mondoo.com/cnquery/v9/providers/os"},"removalDisallowed":{"name":"removalDisallowed","type":"\u0004","is_mandatory":true,"title":"Whether removal of this profile is disallowed by its install settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope this profile applies to","desc":"`system` for `_computerlevel` profiles or `user` for per-user profiles.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Profile type (e.g. \"Configuration\", \"Enrollment Profile\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uuid":{"name":"uuid","type":"\u0007","is_mandatory":true,"title":"Profile UUID","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS Configuration Profile","desc":"Single Configuration Profile: its `identifier`, `uuid`, human-readable `displayName`, `description`, `organization`, `type`, whether it is install-locked (`removalDisallowed`), the scope it applies to (`scope`: `system` or `user`), and the individual `payloads` that carry the actual policy directives.","private":true,"min_provider_version":"13.16.10","defaults":"identifier displayName type","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.profile.payload":{"id":"macos.profile.payload","name":"macos.profile.payload","fields":{"content":{"name":"content","type":"\n","is_mandatory":true,"title":"Raw payload content as parsed from the profile plist","desc":"The schema of `content` is payload-type specific: a firewall payload differs from a Wi-Fi payload differs from a FileVault payload. Inspect `type` to know what fields to expect.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Human-readable payload name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"Reverse-DNS payload identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Payload type (reverse-DNS, e.g. `com.apple.security.firewall`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uuid":{"name":"uuid","type":"\u0007","is_mandatory":true,"title":"Payload UUID","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS Configuration Profile payload","desc":"Single payload within a Configuration Profile: the `type` (e.g. `com.apple.security.firewall`, `com.apple.MCXFileVault2`), the payload's reverse-DNS `identifier`, its `uuid`, and the raw policy `content` as a dict. Audit specific policy directives such as firewall payload settings or FileVault policy.","private":true,"min_provider_version":"13.16.10","defaults":"type displayName","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.profiles":{"id":"macos.profiles","name":"macos.profiles","fields":{"list":{"name":"list","type":"\u0019\u001bmacos.profile","title":"All installed Configuration Profiles","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS configuration profiles installed on the system","desc":"Every Configuration Profile delivered to the device, both MDM-delivered and manually installed `.mobileconfig` payloads, so you can audit what policies are actually in force. Backed by `profiles list -all -output stdout-xml`; requires root to see system-level (`_computerlevel`) profiles, otherwise only the current user's profiles are returned.","min_provider_version":"13.16.10","defaults":"list.length","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.sharing":{"id":"macos.sharing","name":"macos.sharing","fields":{"airplayReceiver":{"name":"airplayReceiver","type":"\u0004","title":"Whether AirPlay Receiver is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"bluetoothSharing":{"name":"bluetoothSharing","type":"\u0004","title":"Whether Bluetooth Sharing is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"contentCaching":{"name":"contentCaching","type":"\u0004","title":"Whether Content Caching is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dvdSharing":{"name":"dvdSharing","type":"\u0004","title":"Whether DVD or CD Sharing is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fileSharing":{"name":"fileSharing","type":"\u0004","title":"Whether File Sharing (SMB/AFP) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"internetSharing":{"name":"internetSharing","type":"\u0004","title":"Whether Internet Sharing is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mediaSharing":{"name":"mediaSharing","type":"\u0004","title":"Whether Media Sharing is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"printerSharing":{"name":"printerSharing","type":"\u0004","title":"Whether Printer Sharing is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remoteManagement":{"name":"remoteManagement","type":"\u0004","title":"Whether Apple Remote Desktop (Remote Management) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"screenSharing":{"name":"screenSharing","type":"\u0004","title":"Whether Screen Sharing (VNC) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS Sharing service state","desc":"State of each toggle in the unified Sharing panel (System Settings \u003e Sharing on macOS Ventura+, System Preferences \u003e Sharing on older versions). CIS macOS benchmarks require most of these off unless the device explicitly needs the service. Backed by `system_profiler SPSharingDataType`, so the values match exactly what the System Settings UI displays.  `system_profiler SPSharingDataType` also reports `Remote Login` and `Remote Apple Events`; those are intentionally not exposed here because `macos.systemsetup.remoteLogin` and `macos.systemsetup.remoteAppleEvents` already cover them via the `systemsetup` CLI. This resource covers the rest of the panel.","min_provider_version":"13.16.10","defaults":"screenSharing remoteManagement airplayReceiver","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.sip":{"id":"macos.sip","name":"macos.sip","fields":{"enabled":{"name":"enabled","type":"\u0004","title":"Whether System Integrity Protection is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"status":{"name":"status","type":"\u0007","title":"SIP status message","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS System Integrity Protection (SIP)","desc":"System Integrity Protection state, the kernel-level protection that restricts modification of protected system files and processes even by root. Exposes whether SIP is `enabled` and the raw `status` message from `csrutil status`. Disabling SIP is a significant hardening regression.","min_provider_version":"13.5.1","defaults":"enabled status","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.softwareupdate":{"id":"macos.softwareupdate","name":"macos.softwareupdate","fields":{"autoCheckEnabled":{"name":"autoCheckEnabled","type":"\u0004","title":"Whether `Software Update` is configured to automatically check for updates","provider":"go.mondoo.com/cnquery/v9/providers/os"},"autoDownloadEnabled":{"name":"autoDownloadEnabled","type":"\u0004","title":"Whether updates are downloaded automatically in the background","provider":"go.mondoo.com/cnquery/v9/providers/os"},"autoInstallMacOSUpdates":{"name":"autoInstallMacOSUpdates","type":"\u0004","title":"Whether macOS updates (point releases and security updates) install automatically","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entry":{"name":"entry","type":"\u001bmacos.softwareupdate.entry","title":"macOS Software Update entry","desc":"Single update offered by Software Update: its `label` (the identifier accepted by `softwareupdate --install`), the human-readable `title` and `version`, the estimated download `size`, whether it is `recommended`, and any post-install `action` such as `restart` or `shutdown`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"installSecurityResponses":{"name":"installSecurityResponses","type":"\u0004","title":"Whether Rapid Security Responses install automatically","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installSystemDataFiles":{"name":"installSystemDataFiles","type":"\u0004","title":"Whether system data files (XProtect, MRT definitions) install automatically","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastSuccessfulCheck":{"name":"lastSuccessfulCheck","type":"\t","title":"Last successful check timestamp as reported by Software Update","desc":"Null when no successful check has ever been recorded on this device or when the field is unset by the policy file.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"updates":{"name":"updates","type":"\u0019\u001bmacos.softwareupdate.entry","title":"Available software updates as reported by `softwareupdate -l --no-scan`","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS Software Update configuration and pending updates","desc":"Automatic-update policy and the list of updates currently available to install. Policy fields read from `/Library/Preferences/com.apple.SoftwareUpdate.plist` (with `/Library/Managed Preferences/` taking precedence when an MDM configuration profile has been delivered). The `updates` list is produced from `softwareupdate -l --no-scan` so it does not initiate a network check.","min_provider_version":"13.16.10","defaults":"autoCheckEnabled autoInstallMacOSUpdates","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.softwareupdate.entry":{"id":"macos.softwareupdate.entry","name":"macos.softwareupdate.entry","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Post-install action required (`restart`, `shutdown`, or empty for none)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"Update label (the argument to `softwareupdate --install`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"recommended":{"name":"recommended","type":"\u0004","is_mandatory":true,"title":"Whether the update is marked recommended","provider":"go.mondoo.com/cnquery/v9/providers/os"},"size":{"name":"size","type":"\u0005","is_mandatory":true,"title":"Estimated download size in KiB as reported by `softwareupdate`","provider":"go.mondoo.com/cnquery/v9/providers/os"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Human-readable update title","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Update version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS Software Update entry","desc":"Single update offered by Software Update: its `label` (the identifier accepted by `softwareupdate --install`), the human-readable `title` and `version`, the estimated download `size`, whether it is `recommended`, and any post-install `action` such as `restart` or `shutdown`.","private":true,"min_provider_version":"13.16.10","defaults":"label title recommended","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.systemExtension":{"id":"macos.systemExtension","name":"macos.systemExtension","fields":{"active":{"name":"active","type":"\u0004","title":"Whether the system extension is active","provider":"go.mondoo.com/cnquery/v9/providers/os"},"bundlePath":{"name":"bundlePath","type":"\u0007","is_mandatory":true,"title":"Path to the system extension","provider":"go.mondoo.com/cnquery/v9/providers/os"},"categories":{"name":"categories","type":"\u0019\u0007","is_mandatory":true,"title":"Categories of the system extension","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","title":"Whether the system extension is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"Identifier of the system extension","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mdmManaged":{"name":"mdmManaged","type":"\u0004","is_mandatory":true,"title":"Whether the system extension is MDM managed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Lifecycle state string reported by the extension (contains \"enabled\" and/or \"activated\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"teamID":{"name":"teamID","type":"\u0007","is_mandatory":true,"title":"Team identifier of the system extension","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uuid":{"name":"uuid","type":"\u0007","is_mandatory":true,"title":"System extension unique identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Version of the system extension","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS system extension","desc":"Installed system extension read from /Library/SystemExtensions/db.plist: its `identifier`, `uuid`, `version`, `teamID` of the signing developer, declared `categories` (such as network or endpoint-security extensions), and `bundlePath`. The `state` string reports the extension's lifecycle, with `enabled` and `active` derived from it. `mdmManaged` is true when the extension or its team is allowlisted by an MDM system-extension policy, which distinguishes centrally approved extensions from user-installed ones.","private":true,"min_provider_version":"11.2.20","defaults":"teamID identifier version state","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.systemsetup":{"id":"macos.systemsetup","name":"macos.systemsetup","fields":{"allowPowerButtonToSleepComputer":{"name":"allowPowerButtonToSleepComputer","type":"\u0007","title":"Whether the power button can sleep the computer","provider":"go.mondoo.com/cnquery/v9/providers/os"},"computerName":{"name":"computerName","type":"\u0007","title":"Computer name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"date":{"name":"date","type":"\u0007","title":"Current date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableKeyboardWhenEnclosureLockIsEngaged":{"name":"disableKeyboardWhenEnclosureLockIsEngaged","type":"\u0007","title":"Whether the keyboard is disabled when the X Serve enclosure lock is engaged","provider":"go.mondoo.com/cnquery/v9/providers/os"},"displaySleep":{"name":"displaySleep","type":"\u0007","title":"Amount of idle time until the display sleeps","provider":"go.mondoo.com/cnquery/v9/providers/os"},"harddiskSleep":{"name":"harddiskSleep","type":"\u0007","title":"Amount of idle time until the hard disk sleeps","provider":"go.mondoo.com/cnquery/v9/providers/os"},"localSubnetName":{"name":"localSubnetName","type":"\u0007","title":"Local subnet name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"networkTimeServer":{"name":"networkTimeServer","type":"\u0007","title":"Configured network time server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remoteAppleEvents":{"name":"remoteAppleEvents","type":"\u0007","title":"Whether remote Apple events are on or off","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remoteLogin":{"name":"remoteLogin","type":"\u0007","title":"Whether remote login (SSH) is on or off","provider":"go.mondoo.com/cnquery/v9/providers/os"},"restartFreeze":{"name":"restartFreeze","type":"\u0007","title":"Whether restart on freeze is on or off","provider":"go.mondoo.com/cnquery/v9/providers/os"},"restartPowerFailure":{"name":"restartPowerFailure","type":"\u0007","title":"Whether restart on power failure is on or off","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sleep":{"name":"sleep","type":"\u0019\u0007","title":"Amount of idle time until the machine sleeps","provider":"go.mondoo.com/cnquery/v9/providers/os"},"startupDisk":{"name":"startupDisk","type":"\u0007","title":"Current startup disk","provider":"go.mondoo.com/cnquery/v9/providers/os"},"time":{"name":"time","type":"\u0007","title":"Current time in 24-hour format","provider":"go.mondoo.com/cnquery/v9/providers/os"},"timeZone":{"name":"timeZone","type":"\u0007","title":"Current time zone","provider":"go.mondoo.com/cnquery/v9/providers/os"},"usingNetworkTime":{"name":"usingNetworkTime","type":"\u0007","title":"Whether network time is on or off","provider":"go.mondoo.com/cnquery/v9/providers/os"},"waitForStartupAfterPowerFailure":{"name":"waitForStartupAfterPowerFailure","type":"\u0007","title":"Number of seconds after which the computer will start up after a power failure","provider":"go.mondoo.com/cnquery/v9/providers/os"},"wakeOnModem":{"name":"wakeOnModem","type":"\u0007","title":"Whether wake on modem is on or off","provider":"go.mondoo.com/cnquery/v9/providers/os"},"wakeOnNetworkAccess":{"name":"wakeOnNetworkAccess","type":"\u0007","title":"Whether wake on network access is on or off","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS machine settings via the systemsetup CLI","desc":"Date/time, sleep and wake, remote login, power, and network-time settings surfaced by the `systemsetup` CLI, with each field mapping to one `systemsetup -get*` query. Requires at least admin privileges to run.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.timemachine":{"id":"macos.timemachine","name":"macos.timemachine","fields":{"preferences":{"name":"preferences","type":"\n","title":"Time Machine preferences (destinations, schedule, and exclusions) as a dict","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS Time Machine backup configuration","desc":"Time Machine backup configuration read from its preferences: configured backup destinations, the automatic backup schedule, and the paths excluded from backups, exposed as the raw `preferences` dict.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macos.xprotect":{"id":"macos.xprotect","name":"macos.xprotect","fields":{"modified":{"name":"modified","type":"\t","title":"Last modification time of the XProtect bundle","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mrtModified":{"name":"mrtModified","type":"\t","title":"Last modification time of MRT.app, null when MRT is not installed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mrtVersion":{"name":"mrtVersion","type":"\u0007","title":"MRT (Malware Removal Tool) bundle version","desc":"Empty string when MRT.app is not installed (it was sunset in macOS 13; its work is now performed by XProtectRemediator).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"XProtect bundle version (CFBundleShortVersionString)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"macOS XProtect anti-malware bundle","desc":"Version and last-modified timestamp of the XProtect signature bundle (and, when present, the legacy Malware Removal Tool). CIS macOS benchmarks expect XProtect signatures to be current; checking `modified` against the auditor's freshness threshold catches devices that have stopped receiving updates.  XProtect.bundle lives at `/Library/Apple/System/Library/CoreServices/XProtect.bundle` on modern macOS (with `/System/Library/CoreServices/XProtect.bundle` as the legacy fallback). `mrtVersion` and `mrtModified` are empty or null on macOS 13+ where MRT has been retired in favor of XProtectRemediator.","min_provider_version":"13.16.10","defaults":"version modified","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mdadm":{"id":"mdadm","name":"mdadm","fields":{"array":{"name":"array","type":"\u001bmdadm.array","title":"Linux software RAID array","desc":"Single mdadm array. `level` is the RAID level, `state` is its health, and the device counts (`activeDevices`, `workingDevices`, `failedDevices`, `spareDevices`) together with `resyncProgress` reveal whether the array is healthy, degraded, or rebuilding. `devices` lists the member block devices.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"arrays":{"name":"arrays","type":"\u0019\u001bmdadm.array","title":"List of all discovered RAID arrays","provider":"go.mondoo.com/cnquery/v9/providers/os"},"device":{"name":"device","type":"\u001bmdadm.device","title":"Member device in a software RAID array","desc":"Single member of an mdadm array. `name` is the block device path, `role` is its slot number in the array layout, and `state` reports its condition (e.g. \"active sync\", \"spare\", \"faulty\").","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"title":"Linux software RAID arrays (mdadm)","desc":"Software RAID arrays managed by mdadm, each with its RAID level, health state, device counts, and resync progress. Iterate `arrays` to audit redundancy and spot degraded or rebuilding arrays. Use `arrays.where(state == \"degraded\")` to find arrays that have lost a member.","min_provider_version":"13.1.2","defaults":"arrays","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mdadm.array":{"id":"mdadm.array","name":"mdadm.array","fields":{"activeDevices":{"name":"activeDevices","type":"\u0005","is_mandatory":true,"title":"Number of active devices in the array","provider":"go.mondoo.com/cnquery/v9/providers/os"},"devices":{"name":"devices","type":"\u0019\u001bmdadm.device","title":"Member devices in the array","provider":"go.mondoo.com/cnquery/v9/providers/os"},"failedDevices":{"name":"failedDevices","type":"\u0005","is_mandatory":true,"title":"Number of failed devices in the array","provider":"go.mondoo.com/cnquery/v9/providers/os"},"level":{"name":"level","type":"\u0007","is_mandatory":true,"title":"RAID level (e.g., raid0, raid1, raid5, raid6, raid10, linear)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Device name (e.g., /dev/md0)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"resyncProgress":{"name":"resyncProgress","type":"\u0006","is_mandatory":true,"title":"Rebuild/resync progress percentage (0-100, -1 if not rebuilding)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"size":{"name":"size","type":"\u0005","is_mandatory":true,"title":"Total size of the array in KiB","provider":"go.mondoo.com/cnquery/v9/providers/os"},"spareDevices":{"name":"spareDevices","type":"\u0005","is_mandatory":true,"title":"Number of spare devices in the array","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Array state (e.g., clean, active, degraded, inactive)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uuid":{"name":"uuid","type":"\u0007","is_mandatory":true,"title":"UUID of the array","provider":"go.mondoo.com/cnquery/v9/providers/os"},"workingDevices":{"name":"workingDevices","type":"\u0005","is_mandatory":true,"title":"Number of working devices in the array","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Linux software RAID array","desc":"Single mdadm array. `level` is the RAID level, `state` is its health, and the device counts (`activeDevices`, `workingDevices`, `failedDevices`, `spareDevices`) together with `resyncProgress` reveal whether the array is healthy, degraded, or rebuilding. `devices` lists the member block devices.","private":true,"min_provider_version":"13.1.2","defaults":"name level state","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mdadm.device":{"id":"mdadm.device","name":"mdadm.device","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Device path (e.g., /dev/sda1)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"role":{"name":"role","type":"\u0005","is_mandatory":true,"title":"Role number in the array","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Device state (e.g., active sync, spare, faulty)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Member device in a software RAID array","desc":"Single member of an mdadm array. `name` is the block device path, `role` is its slot number in the array layout, and `state` reports its condition (e.g. \"active sync\", \"spare\", \"faulty\").","private":true,"min_provider_version":"13.1.2","defaults":"name state","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mistral":{"id":"mistral","fields":{"vibe":{"name":"vibe","type":"\u001bmistral.vibe","title":"Mistral Vibe (Mistral AI) instance","desc":"Mistral Vibe, Mistral AI's coding assistant, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .vibe in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://docs.mistral.ai/tools/vibe/","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"}},"is_extension":true},"mistral.vibe":{"id":"mistral.vibe","name":"mistral.vibe","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Mistral Vibe configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bmistral.vibe.skill","title":"Mistral Vibe skill","desc":"A single SKILL.md definition discovered for the Mistral Vibe agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bmistral.vibe.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Mistral Vibe (Mistral AI) instance","desc":"Mistral Vibe, Mistral AI's coding assistant, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .vibe in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://docs.mistral.ai/tools/vibe/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"mistral.vibe.skill":{"id":"mistral.vibe.skill","name":"mistral.vibe.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Mistral Vibe skill","desc":"A single SKILL.md definition discovered for the Mistral Vibe agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"modprobe":{"id":"modprobe","name":"modprobe","fields":{"alias":{"name":"alias","type":"\u001bmodprobe.alias","title":"Kernel module alias directive","desc":"A single `alias` line from a modprobe configuration file mapping an alias name or wildcard pattern to a target module. The kernel resolves the alias to `module` when the pattern is requested. A common hardening technique points a module's alias at a no-op (for example aliasing an unused network protocol to `off`) to block on-demand loading.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"aliases":{"name":"aliases","type":"\u0019\u001bmodprobe.alias","refs":["\"files\""],"title":"Module aliases","provider":"go.mondoo.com/cnquery/v9/providers/os"},"blacklist":{"name":"blacklist","type":"\u001bmodprobe.blacklist","title":"Kernel module blacklist directive","desc":"A single `blacklist` line from a modprobe configuration file that stops a kernel module from being selected automatically. Auditing these confirms unwanted modules (for example `usb-storage`, `cramfs`, or unused filesystem and protocol drivers) are disabled per CIS hardening guidance. `module` is the blacklisted module name and `file`/`lineNumber` locate the declaration.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"blacklists":{"name":"blacklists","type":"\u0019\u001bmodprobe.blacklist","refs":["\"files\""],"title":"Blacklisted modules","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bfile","title":"List of files that make up the modprobe configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"install":{"name":"install","type":"\u001bmodprobe.install","title":"Install directive for module loading","desc":"One `install` directive from modprobe.d: the module it applies to and the command run in place of the default insmod. A blacklist technique when the command is `/bin/true` or `/bin/false`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"installs":{"name":"installs","type":"\u0019\u001bmodprobe.install","refs":["\"files\""],"title":"Install directives (custom commands for loading modules)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"option":{"name":"option","type":"\u001bmodprobe.option","title":"Kernel module options directive","desc":"A single `options` line from a modprobe configuration file that sets load-time parameters for a kernel module. `parameters` is the raw argument string and `params` parses it into key/value pairs. Used to verify security-relevant module settings, for example that a driver is loaded with a hardened option.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"options":{"name":"options","type":"\u0019\u001bmodprobe.option","refs":["\"files\""],"title":"Module options and parameters","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remove":{"name":"remove","type":"\u001bmodprobe.remove","title":"Remove directive for module unloading","desc":"One `remove` directive from modprobe.d: the module it applies to and the command run in place of the default rmmod.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"removes":{"name":"removes","type":"\u0019\u001bmodprobe.remove","refs":["\"files\""],"title":"Remove directives (custom commands for unloading modules)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"softdep":{"name":"softdep","type":"\u001bmodprobe.softdep","title":"Kernel module soft dependency directive","desc":"A single `softdep` line from a modprobe configuration file declaring modules to load before (`pre`) and after (`post`) a given module. Soft dependencies are advisory, so a missing dependency does not block the module from loading.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"softdeps":{"name":"softdeps","type":"\u0019\u001bmodprobe.softdep","refs":["\"files\""],"title":"Soft dependencies","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"Kernel module configuration (modprobe.d)","desc":"Install, remove, blacklist, options, alias, and softdep directives parsed from the modprobe configuration files. Use blacklists to verify that risky kernel modules are prevented from loading and options to audit module parameters. Point at an alternate config with the `path` argument.","min_provider_version":"11.4.84","defaults":"blacklists installs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modprobe.alias":{"id":"modprobe.alias","name":"modprobe.alias","fields":{"alias":{"name":"alias","type":"\u0007","is_mandatory":true,"title":"Alias name (pattern or wildcard)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"File where this entry is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"module":{"name":"module","type":"\u0007","is_mandatory":true,"title":"Target module the alias resolves to","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Kernel module alias directive","desc":"A single `alias` line from a modprobe configuration file mapping an alias name or wildcard pattern to a target module. The kernel resolves the alias to `module` when the pattern is requested. A common hardening technique points a module's alias at a no-op (for example aliasing an unused network protocol to `off`) to block on-demand loading.","private":true,"min_provider_version":"11.4.84","defaults":"alias module","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modprobe.blacklist":{"id":"modprobe.blacklist","name":"modprobe.blacklist","fields":{"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"File where this entry is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"module":{"name":"module","type":"\u0007","is_mandatory":true,"title":"Module name that is blacklisted","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Kernel module blacklist directive","desc":"A single `blacklist` line from a modprobe configuration file that stops a kernel module from being selected automatically. Auditing these confirms unwanted modules (for example `usb-storage`, `cramfs`, or unused filesystem and protocol drivers) are disabled per CIS hardening guidance. `module` is the blacklisted module name and `file`/`lineNumber` locate the declaration.","private":true,"min_provider_version":"11.4.84","defaults":"module","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modprobe.install":{"id":"modprobe.install","name":"modprobe.install","fields":{"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Command to execute instead of default insmod","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"File where this entry is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"module":{"name":"module","type":"\u0007","is_mandatory":true,"title":"Module name","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Install directive for module loading","desc":"One `install` directive from modprobe.d: the module it applies to and the command run in place of the default insmod. A blacklist technique when the command is `/bin/true` or `/bin/false`.","private":true,"min_provider_version":"11.4.84","defaults":"module command","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modprobe.option":{"id":"modprobe.option","name":"modprobe.option","fields":{"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"File where this entry is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"module":{"name":"module","type":"\u0007","is_mandatory":true,"title":"Module name the options apply to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parameters":{"name":"parameters","type":"\u0007","is_mandatory":true,"title":"Raw parameters string as written after the module name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","title":"Parsed parameters as key/value pairs (bare flags map to `true`)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Kernel module options directive","desc":"A single `options` line from a modprobe configuration file that sets load-time parameters for a kernel module. `parameters` is the raw argument string and `params` parses it into key/value pairs. Used to verify security-relevant module settings, for example that a driver is loaded with a hardened option.","private":true,"min_provider_version":"11.4.84","defaults":"module","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modprobe.remove":{"id":"modprobe.remove","name":"modprobe.remove","fields":{"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Command to execute instead of default rmmod","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"File where this entry is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"module":{"name":"module","type":"\u0007","is_mandatory":true,"title":"Module name","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Remove directive for module unloading","desc":"One `remove` directive from modprobe.d: the module it applies to and the command run in place of the default rmmod.","private":true,"min_provider_version":"11.4.84","defaults":"module command","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modprobe.softdep":{"id":"modprobe.softdep","name":"modprobe.softdep","fields":{"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"File where this entry is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"module":{"name":"module","type":"\u0007","is_mandatory":true,"title":"Module the soft dependency is declared for","provider":"go.mondoo.com/cnquery/v9/providers/os"},"post":{"name":"post","type":"\u0019\u0007","is_mandatory":true,"title":"Modules to load after (post: dependencies)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pre":{"name":"pre","type":"\u0019\u0007","is_mandatory":true,"title":"Modules to load before (pre: dependencies)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Kernel module soft dependency directive","desc":"A single `softdep` line from a modprobe configuration file declaring modules to load before (`pre`) and after (`post`) a given module. Soft dependencies are advisory, so a missing dependency does not block the module from loading.","private":true,"min_provider_version":"11.4.84","defaults":"module","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mondoo":{"id":"mondoo","fields":{"eol":{"name":"eol","type":"\u001bmondoo.eol","title":"Platform end-of-life information","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"mondoo.eol":{"id":"mondoo.eol","name":"mondoo.eol","fields":{"date":{"name":"date","type":"\t","title":"End-of-life date for the product","provider":"go.mondoo.com/cnquery/v9/providers/os"},"product":{"name":"product","type":"\u0007","is_mandatory":true,"title":"Product name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Product version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Platform end-of-life information","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mount":{"id":"mount","name":"mount","fields":{"list":{"name":"list","type":"\u0019\u001bmount.point","provider":"go.mondoo.com/cnquery/v9/providers/os"},"point":{"name":"point","type":"\u001bmount.point","title":"Unix mount point","desc":"A single mounted filesystem: the backing `device`, the `path` where it is attached, the `fstype`, mount `options`, whether it is currently `mounted`, and the total, used, and available bytes. Select a mount by path, for example `mount.point(path: \"/var\")`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"list_type":"\u001bmount.point","title":"Unix mount table","desc":"Every mounted filesystem on the host as a list of `mount.point` entries, each with its backing device, mount path, filesystem type, options, and capacity. Filter it to surface findings such as temporary or removable-media mounts missing `nosuid`, `nodev`, or `noexec` options.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mount.point":{"id":"mount.point","name":"mount.point","fields":{"available":{"name":"available","type":"\u0005","title":"Available space in bytes","min_provider_version":"13.2.8","provider":"go.mondoo.com/cnquery/v9/providers/os"},"device":{"name":"device","type":"\u0007","is_mandatory":true,"title":"Block device or filesystem source backing the mount (e.g., /dev/sda1)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fstype":{"name":"fstype","type":"\u0007","is_mandatory":true,"title":"File system type (e.g., ext4, xfs, tmpfs, nfs)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mounted":{"name":"mounted","type":"\u0004","is_mandatory":true,"title":"Whether the mount point is currently mounted","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Mount options as a name-to-value map (flag-only options map to an empty value)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Mount point path where the filesystem is attached (e.g., /var)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"size":{"name":"size","type":"\u0005","title":"Total size in bytes","min_provider_version":"13.2.8","provider":"go.mondoo.com/cnquery/v9/providers/os"},"used":{"name":"used","type":"\u0005","title":"Used space in bytes","min_provider_version":"13.2.8","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"Unix mount point","desc":"A single mounted filesystem: the backing `device`, the `path` where it is attached, the `fstype`, mount `options`, whether it is currently `mounted`, and the total, used, and available bytes. Select a mount by path, for example `mount.point(path: \"/var\")`.","min_provider_version":"9.0.1","defaults":"device path fstype","provider":"go.mondoo.com/cnquery/v9/providers/os"},"network":{"id":"network","name":"network","fields":{"interfaces":{"name":"interfaces","type":"\u0019\u001bnetworkInterface","title":"Network interfaces","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ipv4":{"name":"ipv4","type":"\u0019\u000f","title":"All IPv4 addresses detected on host interfaces","min_provider_version":"13.0.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ipv6":{"name":"ipv6","type":"\u0019\u000f","title":"All IPv6 addresses detected on host interfaces","min_provider_version":"13.0.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"neighbors":{"name":"neighbors","type":"\u0019\u001bnetworkNeighbor","title":"ARP (IPv4) / NDP (IPv6) neighbor cache entries","min_provider_version":"13.28.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"primaryIPv4":{"name":"primaryIPv4","type":"\u000f","title":"Primary IPv4 address determined by the default route","min_provider_version":"13.0.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"primaryIPv6":{"name":"primaryIPv6","type":"\u000f","title":"Primary IPv6 address determined by the default route","min_provider_version":"13.0.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"routes":{"name":"routes","type":"\u001bnetworkRoutes","title":"Routes","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Network configuration of this system","desc":"Host networking view: the network interfaces and their addresses, the routing table (including default routes), the IPv4 and IPv6 addresses detected across interfaces, the primary addresses chosen by the default route, and the ARP / NDP neighbor cache.","min_provider_version":"11.3.42","provider":"go.mondoo.com/cnquery/v9/providers/os"},"networkInterface":{"id":"networkInterface","name":"networkInterface","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Status of the network interface","provider":"go.mondoo.com/cnquery/v9/providers/os"},"flags":{"name":"flags","type":"\u0019\u0007","is_mandatory":true,"title":"Information about an interface's status and capabilities","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ips":{"name":"ips","type":"\u0019\u001bipAddress","is_mandatory":true,"title":"List of IP addresses assigned to the network interface (v4 and v6)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mac":{"name":"mac","type":"\u0007","is_mandatory":true,"title":"Unique 12-digit hexadecimal identifier assigned by the manufacturer","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mtu":{"name":"mtu","type":"\u0005","is_mandatory":true,"title":"Maximum transmission unit","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the network interface","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vendor":{"name":"vendor","type":"\u0007","is_mandatory":true,"title":"Company that manufactures the network interface","provider":"go.mondoo.com/cnquery/v9/providers/os"},"virtual":{"name":"virtual","type":"\u0004","is_mandatory":true,"title":"Whether a network interface is virtual of not","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Detailed information of a network interface","desc":"Single network interface and its properties: the `name`, the hardware `mac` address and its `vendor`, the assigned IPv4 and IPv6 addresses, the `mtu`, the interface `flags`, whether it is `active`, and whether it is a `virtual` interface.","private":true,"min_provider_version":"11.3.42","defaults":"name mac active","provider":"go.mondoo.com/cnquery/v9/providers/os"},"networkNeighbor":{"id":"networkNeighbor","name":"networkNeighbor","fields":{"interface":{"name":"interface","type":"\u0007","is_mandatory":true,"title":"Network interface the neighbor was observed on","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ip":{"name":"ip","type":"\u000f","is_mandatory":true,"title":"Neighbor IP address (v4 or v6)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mac":{"name":"mac","type":"\u0007","is_mandatory":true,"title":"Link-layer (MAC) address; empty for incomplete or failed entries","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Neighbor cache state (e.g. reachable, stale, permanent, incomplete)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Network neighbor (ARP / NDP cache entry)","desc":"Single entry from the system's ARP (IPv4) or NDP (IPv6) neighbor cache: the neighbor's `ip`, its `mac` (link-layer address, empty for incomplete entries), the `interface` it was observed on, and the cache `state` (e.g. reachable, stale, permanent, incomplete). Backed by `ip -j neigh` or `/proc/net/arp` on Linux, `arp -an` on macOS, and Get-NetNeighbor on Windows.","private":true,"min_provider_version":"13.28.2","defaults":"ip mac interface state","provider":"go.mondoo.com/cnquery/v9/providers/os"},"networkRoute":{"id":"networkRoute","name":"networkRoute","fields":{"destination":{"name":"destination","type":"\u0007","is_mandatory":true,"title":"Destination network or destination subnet for this route","provider":"go.mondoo.com/cnquery/v9/providers/os"},"flags":{"name":"flags","type":"\u0019\u0007","is_mandatory":true,"title":"Flags that describe route properties (e.g., 'UG' for up/gateway)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"gateway":{"name":"gateway","type":"\u0007","is_mandatory":true,"title":"Gateway IP address for this route","provider":"go.mondoo.com/cnquery/v9/providers/os"},"iface":{"name":"iface","type":"\u001bnetworkInterface","title":"Network interface this route applies to","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Network route information","desc":"Single routing-table entry: the `destination` network, the `gateway` it forwards through, the route `flags` (e.g. 'UG' for up/gateway), and the `iface` the route applies to.","private":true,"min_provider_version":"11.4.69","defaults":"destination flags","provider":"go.mondoo.com/cnquery/v9/providers/os"},"networkRoutes":{"id":"networkRoutes","name":"networkRoutes","fields":{"defaults":{"name":"defaults","type":"\u0019\u001bnetworkRoute","title":"Default routes found on the machine","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bnetworkRoute","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bnetworkRoute","title":"Collection of routing table entries on the system","desc":"All routes in the system routing table, with `defaults` returning just the default routes (those matching any destination).","private":true,"min_provider_version":"11.4.69","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nfs":{"id":"nfs","name":"nfs","fields":{"export":{"name":"export","type":"\u001bnfs.export","title":"NFS export entry for a single path and client","desc":"One row of the local NFS export table: the directory being shared (`path`), the client specification it is shared with (`client`, a hostname, IP address, CIDR, wildcard, netgroup, or `*` meaning any client) and the effective export `options` as parsed from `/etc/exports`. `readOnly` is true when the share is exported read-only. `noRootSquash` is true when the share grants remote uid 0 on the share, a classic NFS audit finding.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"exports":{"name":"exports","type":"\u0019\u001bnfs.export","title":"NFS exports declared on this host","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mount":{"name":"mount","type":"\u001bnfs.mount","title":"NFS client mount","desc":"One NFS mount currently active on this host. `device` is the NFS source as the kernel sees it (`server:/remote/path`), split into `server` and `remotePath` for convenience. `mountpoint` is where the share is attached locally. `version` is the negotiated NFS protocol version (for example `3`, `4`, `4.1`, `4.2`); empty when the kernel did not report one. `security` is the authentication flavor, one of `sys`, `krb5`, `krb5i`, `krb5p`, or `none`; empty when unspecified. `hardMount` is true when the mount uses hard semantics (the `soft` option is not set). `readOnly` is true when the mount is `ro`. `options` is the full mount option list as reported by the system.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"mounts":{"name":"mounts","type":"\u0019\u001bnfs.mount","title":"NFS mounts currently active on this host","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"NFS service local state","desc":"Local NFS service viewed from two angles: shares this host declares (`exports`) and NFS volumes this host has mounted (`mounts`). `exports` is parsed from `/etc/exports` using the platform-specific syntax for Linux, FreeBSD, macOS, and AIX; each row is one `(path, client)` pair so audits like `nfs.exports.where(noRootSquash)` work directly. `mounts` filters the system mount table for NFS file systems and parses NFS-specific options into fields (protocol `version`, `security` flavor, `hardMount`, `readOnly`).","min_provider_version":"13.19.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nfs.export":{"id":"nfs.export","name":"nfs.export","fields":{"client":{"name":"client","type":"\u0007","is_mandatory":true,"title":"Client specification (hostname, IP, CIDR, wildcard, netgroup, or `*`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"noRootSquash":{"name":"noRootSquash","type":"\u0004","is_mandatory":true,"title":"Whether the share grants remote uid 0 (`no_root_squash`, `maproot=root`, or `root=`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"Export options as parsed from /etc/exports","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Exported directory path on the local host","provider":"go.mondoo.com/cnquery/v9/providers/os"},"readOnly":{"name":"readOnly","type":"\u0004","is_mandatory":true,"title":"Whether the share is exported read-only","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"NFS export entry for a single path and client","desc":"One row of the local NFS export table: the directory being shared (`path`), the client specification it is shared with (`client`, a hostname, IP address, CIDR, wildcard, netgroup, or `*` meaning any client) and the effective export `options` as parsed from `/etc/exports`. `readOnly` is true when the share is exported read-only. `noRootSquash` is true when the share grants remote uid 0 on the share, a classic NFS audit finding.","private":true,"min_provider_version":"13.19.1","defaults":"path client readOnly noRootSquash","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nfs.mount":{"id":"nfs.mount","name":"nfs.mount","fields":{"device":{"name":"device","type":"\u0007","is_mandatory":true,"title":"NFS source as the kernel sees it (server:/remote/path)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hardMount":{"name":"hardMount","type":"\u0004","is_mandatory":true,"title":"Whether the mount uses hard semantics (the `soft` option is not set)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mountpoint":{"name":"mountpoint","type":"\u0007","is_mandatory":true,"title":"Local mount point path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"Full mount option list as reported by the system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"readOnly":{"name":"readOnly","type":"\u0004","is_mandatory":true,"title":"Whether the mount is read-only","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remotePath":{"name":"remotePath","type":"\u0007","is_mandatory":true,"title":"Remote path exported by the server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"security":{"name":"security","type":"\u0007","is_mandatory":true,"title":"Security flavor: one of `sys`, `krb5`, `krb5i`, `krb5p`, or `none`; empty when unspecified","provider":"go.mondoo.com/cnquery/v9/providers/os"},"server":{"name":"server","type":"\u0007","is_mandatory":true,"title":"NFS server hostname or IP","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"NFS protocol version (for example `3`, `4`, `4.1`, `4.2`); empty when unknown","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"NFS client mount","desc":"One NFS mount currently active on this host. `device` is the NFS source as the kernel sees it (`server:/remote/path`), split into `server` and `remotePath` for convenience. `mountpoint` is where the share is attached locally. `version` is the negotiated NFS protocol version (for example `3`, `4`, `4.1`, `4.2`); empty when the kernel did not report one. `security` is the authentication flavor, one of `sys`, `krb5`, `krb5i`, `krb5p`, or `none`; empty when unspecified. `hardMount` is true when the mount uses hard semantics (the `soft` option is not set). `readOnly` is true when the mount is `ro`. `options` is the full mount option list as reported by the system.","private":true,"min_provider_version":"13.19.1","defaults":"server remotePath mountpoint version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nftables":{"id":"nftables","name":"nftables","fields":{"chain":{"name":"chain","type":"\u001bnftables.chain","title":"nftables chain","desc":"Ordered list of rules within a table. A base chain attaches to a kernel hook and carries a type, hook, priority, and default policy, so it decides the fate of packets that fall through all its rules. A regular (non-base) chain is only reached by an explicit jump or goto and leaves those fields empty. Check `isBaseChain` to distinguish the two, and `policy` (accept or drop) to see the default action for a base chain, which is the key setting for a default-deny firewall.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"chains":{"name":"chains","type":"\u0019\u001bnftables.chain","title":"All chains across all tables","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rule":{"name":"rule","type":"\u001bnftables.rule","title":"nftables rule","desc":"Single rule within a chain, identified by its handle number. The matching criteria and the action (accept, drop, jump, log, and so on) are parsed into `expr` as structured expression data, and `comment` carries any inline rule comment. Use `chainRef` and `tableRef` to walk back to the chain and table that contain the rule.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bnftables.rule","title":"All rules across all tables and chains","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"set":{"name":"set","type":"\u001bnftables.set","title":"nftables named set or map","desc":"Named collection of elements referenced by rules in a table, keyed by family, table, and name. A plain set holds a group of values (addresses, ports, MAC addresses) that rules match against, while a map (`isMap` true, `valueType` non-empty) associates each key with a value for verdict or NAT lookups. The `keyType` gives the element data type (for example ipv4_addr, inet_service, ether_addr), `flags` reports set attributes (constant, interval, timeout, dynamic), and `elements` lists the current members as strings.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"sets":{"name":"sets","type":"\u0019\u001bnftables.set","title":"All named sets across all tables","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"table":{"name":"table","type":"\u001bnftables.table","title":"nftables table","desc":"Top-level container in the nftables ruleset, keyed by address family and name. A table holds the chains, rules, and named sets that make up a firewall configuration. The `family` field selects which protocol the table governs (ip for IPv4, ip6 for IPv6, inet for both, arp, bridge, or netdev), and `flags` reports table attributes such as dormant (rules present but not evaluated), owner, or persist. Traverse `chains`, `rules`, and `sets` to audit the packet-filtering policy defined here.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"tables":{"name":"tables","type":"\u0019\u001bnftables.table","title":"All nftables tables","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"nft version string (e.g., \"1.0.2\")","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"nftables firewall","desc":"The host's nftables ruleset across all address families (ip, ip6, inet, arp, bridge, netdev). Flattened accessors return everything at once: `tables`, `chains` (across all tables), `rules` (across all chains), and named `sets`. nftables is the modern replacement for iptables, so audit it on current distributions to confirm chains have restrictive policies and expected rules.","min_provider_version":"11.8.14","defaults":"tables","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nftables.chain":{"id":"nftables.chain","name":"nftables.chain","fields":{"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"Address family","provider":"go.mondoo.com/cnquery/v9/providers/os"},"handle":{"name":"handle","type":"\u0005","is_mandatory":true,"title":"Chain handle number","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hook":{"name":"hook","type":"\u0007","is_mandatory":true,"title":"Hook point (input, output, forward, prerouting, postrouting, ingress, egress) - only for base chains","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isBaseChain":{"name":"isBaseChain","type":"\u0004","is_mandatory":true,"title":"Whether this is a base chain (has type, hook, and priority)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Chain name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"policy":{"name":"policy","type":"\u0007","is_mandatory":true,"title":"Default policy (accept, drop) - only for base chains","provider":"go.mondoo.com/cnquery/v9/providers/os"},"prio":{"name":"prio","type":"\u0005","is_mandatory":true,"title":"Chain priority - only for base chains","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rules":{"name":"rules","type":"\u0019\u001bnftables.rule","is_mandatory":true,"title":"Rules in this chain","provider":"go.mondoo.com/cnquery/v9/providers/os"},"table":{"name":"table","type":"\u0007","is_mandatory":true,"title":"Name of the table this chain belongs to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tableRef":{"name":"tableRef","type":"\u001bnftables.table","title":"Table this chain belongs to","min_provider_version":"13.17.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Chain type (filter, route, nat) - only for base chains","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"nftables chain","desc":"Ordered list of rules within a table. A base chain attaches to a kernel hook and carries a type, hook, priority, and default policy, so it decides the fate of packets that fall through all its rules. A regular (non-base) chain is only reached by an explicit jump or goto and leaves those fields empty. Check `isBaseChain` to distinguish the two, and `policy` (accept or drop) to see the default action for a base chain, which is the key setting for a default-deny firewall.","private":true,"min_provider_version":"11.8.14","defaults":"family table name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nftables.rule":{"id":"nftables.rule","name":"nftables.rule","fields":{"chain":{"name":"chain","type":"\u0007","is_mandatory":true,"title":"Name of the chain this rule belongs to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"chainRef":{"name":"chainRef","type":"\u001bnftables.chain","title":"Chain this rule belongs to","min_provider_version":"13.17.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Rule comment","provider":"go.mondoo.com/cnquery/v9/providers/os"},"expr":{"name":"expr","type":"\u0019\n","is_mandatory":true,"title":"Rule expressions as structured data","provider":"go.mondoo.com/cnquery/v9/providers/os"},"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"Address family","provider":"go.mondoo.com/cnquery/v9/providers/os"},"handle":{"name":"handle","type":"\u0005","is_mandatory":true,"title":"Rule handle number","provider":"go.mondoo.com/cnquery/v9/providers/os"},"table":{"name":"table","type":"\u0007","is_mandatory":true,"title":"Name of the table this rule belongs to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tableRef":{"name":"tableRef","type":"\u001bnftables.table","title":"Table this rule belongs to","min_provider_version":"13.17.1","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"nftables rule","desc":"Single rule within a chain, identified by its handle number. The matching criteria and the action (accept, drop, jump, log, and so on) are parsed into `expr` as structured expression data, and `comment` carries any inline rule comment. Use `chainRef` and `tableRef` to walk back to the chain and table that contain the rule.","private":true,"min_provider_version":"11.8.14","defaults":"family table chain handle","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nftables.set":{"id":"nftables.set","name":"nftables.set","fields":{"elements":{"name":"elements","type":"\u0019\u0007","is_mandatory":true,"title":"Set elements (values as strings)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"Address family","provider":"go.mondoo.com/cnquery/v9/providers/os"},"flags":{"name":"flags","type":"\u0019\u0007","is_mandatory":true,"title":"Set flags (e.g., \"constant\", \"interval\", \"timeout\", \"dynamic\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"handle":{"name":"handle","type":"\u0005","is_mandatory":true,"title":"Set handle number","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isMap":{"name":"isMap","type":"\u0004","is_mandatory":true,"title":"Whether this is a map (has both key and value types)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"keyType":{"name":"keyType","type":"\u0007","is_mandatory":true,"title":"Element data type (e.g., \"ipv4_addr\", \"inet_service\", \"ether_addr\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Set name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"table":{"name":"table","type":"\u0007","is_mandatory":true,"title":"Name of the table this set belongs to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tableRef":{"name":"tableRef","type":"\u001bnftables.table","title":"Table this set belongs to","min_provider_version":"13.17.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"timeout":{"name":"timeout","type":"\u0005","is_mandatory":true,"title":"Set timeout in seconds (0 if not set)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"valueType":{"name":"valueType","type":"\u0007","is_mandatory":true,"title":"Value data type for maps (empty for plain sets)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"nftables named set or map","desc":"Named collection of elements referenced by rules in a table, keyed by family, table, and name. A plain set holds a group of values (addresses, ports, MAC addresses) that rules match against, while a map (`isMap` true, `valueType` non-empty) associates each key with a value for verdict or NAT lookups. The `keyType` gives the element data type (for example ipv4_addr, inet_service, ether_addr), `flags` reports set attributes (constant, interval, timeout, dynamic), and `elements` lists the current members as strings.","private":true,"min_provider_version":"13.2.9","defaults":"family table name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nftables.table":{"id":"nftables.table","name":"nftables.table","fields":{"chains":{"name":"chains","type":"\u0019\u001bnftables.chain","is_mandatory":true,"title":"Chains in this table","provider":"go.mondoo.com/cnquery/v9/providers/os"},"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"Address family (ip, ip6, inet, arp, bridge, netdev)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"flags":{"name":"flags","type":"\u0019\u0007","is_mandatory":true,"title":"Table flags (e.g., dormant, owner, persist)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"handle":{"name":"handle","type":"\u0005","is_mandatory":true,"title":"Table handle number","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Table name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rules":{"name":"rules","type":"\u0019\u001bnftables.rule","is_mandatory":true,"title":"Rules in this table across all chains","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sets":{"name":"sets","type":"\u0019\u001bnftables.set","is_mandatory":true,"title":"Named sets in this table","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"nftables table","desc":"Top-level container in the nftables ruleset, keyed by address family and name. A table holds the chains, rules, and named sets that make up a firewall configuration. The `family` field selects which protocol the table governs (ip for IPv4, ip6 for IPv6, inet for both, arp, bridge, or netdev), and `flags` reports table attributes such as dormant (rules present but not evaluated), owner, or persist. Traverse `chains`, `rules`, and `sets` to audit the packet-filtering policy defined here.","private":true,"min_provider_version":"11.8.14","defaults":"family name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nginx":{"id":"nginx","name":"nginx","fields":{"conf":{"name":"conf","type":"\u001bnginx.conf","title":"Nginx HTTP Server configuration","desc":"Parsed Nginx configuration covering flat directives, per-server blocks, upstream backend pools, and listen addresses, merged across the main config and every include fragment. Surfaces TLS settings and response headers per server block for hardening audits. Pass `init(path: \"...\")` to point at a non-default config file.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"modules":{"name":"modules","type":"\u0019\u0007","title":"Compiled-in modules from configure arguments","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Nginx version (e.g., \"1.25.3\")","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Nginx HTTP Server","desc":"Nginx daemon version and the modules compiled into the binary. Use nginx.conf for the parsed configuration, including server blocks, upstream pools, and listen addresses.","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nginx.conf":{"id":"nginx.conf","name":"nginx.conf","fields":{"errorLog":{"name":"errorLog","type":"\u0007","refs":["\"params\""],"title":"Error log path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","title":"Primary configuration file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bfile","refs":["\"file\""],"title":"All configuration files (main + included fragments)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpParams":{"name":"httpParams","type":"\u001a\u0007\u0007","refs":["\"file\""],"title":"HTTP-level directives (inside http block, outside server blocks)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"listenAddresses":{"name":"listenAddresses","type":"\u0019\u0007","refs":["\"file\""],"title":"Listen addresses/ports across all server blocks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"location":{"name":"location","type":"\u001bnginx.conf.location","title":"Nginx location block","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"file\""],"title":"Flat key-value directives from main + http context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"server":{"name":"server","type":"\u001bnginx.conf.server","title":"Nginx server block","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"servers":{"name":"servers","type":"\u0019\u001bnginx.conf.server","refs":["\"file\""],"title":"Server blocks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"upstream":{"name":"upstream","type":"\u001bnginx.conf.upstream","title":"Nginx upstream block","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"upstreams":{"name":"upstreams","type":"\u0019\u001bnginx.conf.upstream","refs":["\"file\""],"title":"Upstream blocks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user":{"name":"user","type":"\u0007","refs":["\"params\""],"title":"User directive","provider":"go.mondoo.com/cnquery/v9/providers/os"},"workerProcesses":{"name":"workerProcesses","type":"\u0007","refs":["\"params\""],"title":"Worker processes setting","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"Nginx HTTP Server configuration","desc":"Parsed Nginx configuration covering flat directives, per-server blocks, upstream backend pools, and listen addresses, merged across the main config and every include fragment. Surfaces TLS settings and response headers per server block for hardening audits. Pass `init(path: \"...\")` to point at a non-default config file.","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nginx.conf.location":{"id":"nginx.conf.location","name":"nginx.conf.location","fields":{"fastcgiPass":{"name":"fastcgiPass","type":"\u0007","is_mandatory":true,"title":"fastcgi_pass directive value","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modifier":{"name":"modifier","type":"\u0007","is_mandatory":true,"title":"Location modifier (\"=\", \"~\", \"~*\", \"^~\", or \"\" for prefix-default)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this location block","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Location path or pattern (excluding modifier)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"proxyPass":{"name":"proxyPass","type":"\u0007","is_mandatory":true,"title":"Proxy pass target","provider":"go.mondoo.com/cnquery/v9/providers/os"},"return":{"name":"return","type":"\u0007","is_mandatory":true,"title":"return directive value (status + URI/text)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"root":{"name":"root","type":"\u0007","is_mandatory":true,"title":"Document root override","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tryFiles":{"name":"tryFiles","type":"\u0007","is_mandatory":true,"title":"try_files directive value","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Nginx location block","private":true,"min_provider_version":"13.14.1","defaults":"path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nginx.conf.server":{"id":"nginx.conf.server","name":"nginx.conf.server","fields":{"addHeaders":{"name":"addHeaders","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Response headers from `add_header NAME VALUE` directives (header name -\u003e values)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"certificate":{"name":"certificate","type":"\u0019\u001bcertificate","title":"X.509 certificates parsed from sslCertificate (empty if the file is unreadable)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"listen":{"name":"listen","type":"\u0007","is_mandatory":true,"title":"Listen directives (comma-separated if multiple)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"listens":{"name":"listens","type":"\u0019\n","is_mandatory":true,"title":"Listen directives broken out per declaration (port, ssl, http2, defaultServer, proxyProtocol, address, raw)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"locations":{"name":"locations","type":"\u0019\u001bnginx.conf.location","is_mandatory":true,"title":"Location blocks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this server block","provider":"go.mondoo.com/cnquery/v9/providers/os"},"root":{"name":"root","type":"\u0007","is_mandatory":true,"title":"Document root","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverName":{"name":"serverName","type":"\u0007","is_mandatory":true,"title":"Server name(s)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverTokens":{"name":"serverTokens","type":"\u0007","is_mandatory":true,"title":"server_tokens directive value (on/off/build)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ssl":{"name":"ssl","type":"\u0004","is_mandatory":true,"title":"Whether SSL is configured (any listen line carries `ssl`, or ssl_certificate is set)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslCertificate":{"name":"sslCertificate","type":"\u0007","is_mandatory":true,"title":"Path to the server certificate (ssl_certificate)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslCertificateKey":{"name":"sslCertificateKey","type":"\u0007","is_mandatory":true,"title":"Path to the server private key (ssl_certificate_key)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslCiphers":{"name":"sslCiphers","type":"\u0007","is_mandatory":true,"title":"ssl_ciphers directive value","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslPreferServerCiphers":{"name":"sslPreferServerCiphers","type":"\u0004","is_mandatory":true,"title":"ssl_prefer_server_ciphers directive value (true when \"on\")","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslProtocols":{"name":"sslProtocols","type":"\u0007","is_mandatory":true,"title":"ssl_protocols directive value (e.g., \"TLSv1.2 TLSv1.3\")","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslSessionTickets":{"name":"sslSessionTickets","type":"\u0007","is_mandatory":true,"title":"ssl_session_tickets directive value (\"on\"/\"off\"; empty if unset)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sslSessionTimeout":{"name":"sslSessionTimeout","type":"\u0007","is_mandatory":true,"title":"ssl_session_timeout directive value (e.g., \"1d\")","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Nginx server block","private":true,"min_provider_version":"13.14.1","defaults":"serverName ssl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nginx.conf.upstream":{"id":"nginx.conf.upstream","name":"nginx.conf.upstream","fields":{"keepalive":{"name":"keepalive","type":"\u0005","is_mandatory":true,"title":"keepalive directive value (idle connections per worker; 0 if unset)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"loadBalancingMethod":{"name":"loadBalancingMethod","type":"\u0007","is_mandatory":true,"title":"Load-balancing method (round_robin, least_conn, ip_hash, hash, random, least_time)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Upstream group name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All directives within this upstream block","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverDetails":{"name":"serverDetails","type":"\u0019\n","is_mandatory":true,"title":"Parsed backend entries (address, weight, maxFails, failTimeout, backup, down, slowStart, route)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"servers":{"name":"servers","type":"\u0019\u0007","is_mandatory":true,"title":"Backend server addresses (raw `server` directive arguments)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Nginx upstream block","private":true,"min_provider_version":"13.14.1","defaults":"name loadBalancingMethod","provider":"go.mondoo.com/cnquery/v9/providers/os"},"npm":{"id":"npm","fields":{"package":{"name":"package","type":"\u001bnpm.package","title":"npm package dependency","desc":"A single npm package: its unique `id`, `name`, `version`, `purl`, CPEs, and the files that contributed it. Iterated from `npm.packages` for the full dependency tree or from `directDependencies` for top-level dependencies only.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bnpm.packages","title":"npm package inventory","desc":"npm packages discovered under a project: the `root` package, the `directDependencies`, and the full transitive tree (iterated from the list itself). `scripts` exposes the `package.json` scripts (useful for spotting risky lifecycle hooks) and `files` records which manifests and lockfiles contributed the inventory. Pass `paths` to search specific locations.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"npm.package":{"id":"npm.package","name":"npm.package","fields":{"author":{"name":"author","type":"\u0007","is_mandatory":true,"title":"Package author","desc":"From package.json `author`. Accepts the SPDX-style string form (\"Name \u003cemail\u003e\") and the object form ({\"name\":..., \"email\":..., \"url\":...}); only the name portion is surfaced.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cpes":{"name":"cpes","type":"\u0019\u001bcpe","title":"Common Platform Enumeration (CPE) for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Package description from package.json","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Package files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID is the npm.package unique identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"license":{"name":"license","type":"\u0007","is_mandatory":true,"title":"Package license","desc":"SPDX expression from package.json `license`. The deprecated `licenses` array is not yet supported, so the field is empty in that case.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Name of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Version of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"npm package dependency","desc":"A single npm package: its unique `id`, `name`, `version`, `purl`, CPEs, and the files that contributed it. Iterated from `npm.packages` for the full dependency tree or from `directDependencies` for top-level dependencies only.","min_provider_version":"10.2.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"npm.packages":{"id":"npm.packages","name":"npm.packages","fields":{"directDependencies":{"name":"directDependencies","type":"\u0019\u001bnpm.package","title":"List of direct dependencies","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bnpm.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for packages","desc":"Deprecated in favor of `paths`, which accepts a list of search paths.","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"deprecated"},"paths":{"name":"paths","type":"\u0019\u0007","title":"Optional: list of paths searched for packages","min_provider_version":"11.4.67","provider":"go.mondoo.com/cnquery/v9/providers/os"},"root":{"name":"root","type":"\u001bnpm.package","title":"Root Package (may not exist)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scripts":{"name":"scripts","type":"\u001a\u0007\u0007","title":"Scripts defined in package.json","min_provider_version":"11.4.63","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bnpm.package","title":"npm package inventory","desc":"npm packages discovered under a project: the `root` package, the `directDependencies`, and the full transitive tree (iterated from the list itself). `scripts` exposes the `package.json` scripts (useful for spotting risky lifecycle hooks) and `files` records which manifests and lockfiles contributed the inventory. Pass `paths` to search specific locations.","min_provider_version":"10.2.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ntp":{"id":"ntp","fields":{"conf":{"name":"conf","type":"\u001bntp.conf","title":"NTP daemon configuration","desc":"Classic ntpd configuration parsed into structured directives. `servers` lists the configured upstream time sources, `restrict` reports the access control directives that govern which peers and clients may interact with the daemon, and `fudge` carries reference-clock adjustments. `settings` returns every effective directive line. Select a file with `ntp.conf(path: \"...\")`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"ntp.conf":{"id":"ntp.conf","name":"ntp.conf","fields":{"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"Raw contents of the NTP service configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","title":"File of the NTP service configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fudge":{"name":"fudge","type":"\u0019\u0007","refs":["\"settings\""],"title":"Additional information for clock drivers","provider":"go.mondoo.com/cnquery/v9/providers/os"},"restrict":{"name":"restrict","type":"\u0019\u0007","refs":["\"settings\""],"title":"List of access control restrictions for the NTP service","provider":"go.mondoo.com/cnquery/v9/providers/os"},"servers":{"name":"servers","type":"\u0019\u0007","refs":["\"settings\""],"title":"List of servers for the NTP service","provider":"go.mondoo.com/cnquery/v9/providers/os"},"settings":{"name":"settings","type":"\u0019\u0007","refs":["\"content\""],"title":"List of settings for the NTP service","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"NTP daemon configuration","desc":"Classic ntpd configuration parsed into structured directives. `servers` lists the configured upstream time sources, `restrict` reports the access control directives that govern which peers and clients may interact with the daemon, and `fudge` carries reference-clock adjustments. `settings` returns every effective directive line. Select a file with `ntp.conf(path: \"...\")`.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"openBSMAudit":{"id":"openBSMAudit","name":"openBSMAudit","fields":{"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"Content of the audit_control file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dir":{"name":"dir","type":"\u0007","refs":["\"params\""],"title":"Directory where audit log files are stored","provider":"go.mondoo.com/cnquery/v9/providers/os"},"expireAfter":{"name":"expireAfter","type":"\u0007","refs":["\"params\""],"title":"Expiration criteria for audit logs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","title":"File resource for the audit_control file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"filesz":{"name":"filesz","type":"\u0007","refs":["\"params\""],"title":"Maximum size of individual audit log files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"flags":{"name":"flags","type":"\u0019\u0007","refs":["\"params\""],"title":"Audit event flags for attributable (user) events","provider":"go.mondoo.com/cnquery/v9/providers/os"},"memberClearSflagsMask":{"name":"memberClearSflagsMask","type":"\u0019\u0007","refs":["\"params\""],"title":"Flags that non-superusers can clear on their processes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"memberSetSflagsMask":{"name":"memberSetSflagsMask","type":"\u0019\u0007","refs":["\"params\""],"title":"Flags that non-superusers can set on their processes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"minfree":{"name":"minfree","type":"\u0005","refs":["\"params\""],"title":"Minimum free space threshold (percentage) before audit warnings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"naflags":{"name":"naflags","type":"\u0019\u0007","refs":["\"params\""],"title":"Audit event flags for non-attributable events","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"content\""],"title":"Parsed parameters from the audit_control file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the audit_control file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"policy":{"name":"policy","type":"\u0019\u0007","refs":["\"params\""],"title":"Audit policy settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"superuserClearSflagsMask":{"name":"superuserClearSflagsMask","type":"\u0019\u0007","refs":["\"params\""],"title":"Flags that superusers can clear on their processes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"superuserSetSflagsMask":{"name":"superuserSetSflagsMask","type":"\u0019\u0007","refs":["\"params\""],"title":"Flags that superusers can set on their processes","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"OpenBSM audit_control configuration (macOS and BSD)","desc":"OpenBSM audit subsystem configuration parsed from the `audit_control` file (pass `path` to override the default location). Exposes the audit event `flags`, log retention (`expireAfter`, `filesz`, `minfree`), and policy parameters that govern which security-relevant events the kernel records.","min_provider_version":"11.4.84","defaults":"path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"openai":{"id":"openai","fields":{"codex":{"name":"codex","type":"\u001bopenai.codex","title":"OpenAI Codex CLI instance","desc":"OpenAI Codex CLI installation on the host, exposing the `authMode` and `accountId` it is signed in with, the installed `version`, and the agent's configured surface: `plugins`, `skills`, `mcpServers`, and OAuth `connectors`. Audit which plugins, MCP servers, and connectors are configured. The `configPath` selects the configuration directory when it is not the default. URL: https://openai.com/index/introducing-codex/","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"}},"is_extension":true},"openai.codex":{"id":"openai.codex","name":"openai.codex","fields":{"accountId":{"name":"accountId","type":"\u0007","title":"Account ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"authMode":{"name":"authMode","type":"\u0007","title":"Authentication mode (e.g. \"chatgpt\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Codex configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"connector":{"name":"connector","type":"\u001bopenai.codex.connector","title":"OpenAI Codex OAuth app connector","desc":"OAuth application connector declared by a Codex plugin, granting the agent delegated access to a third-party service. The id identifies the connected app (for example \"connector_...\" or \"asdk_app_...\") and plugin records which plugin declared it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"connectors":{"name":"connectors","type":"\u0019\u001bopenai.codex.connector","title":"OAuth app connectors","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastRefresh":{"name":"lastRefresh","type":"\u0007","title":"Last refresh timestamp","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mcpServer":{"name":"mcpServer","type":"\u001bopenai.codex.mcpServer","title":"OpenAI Codex MCP server","desc":"Model Context Protocol server a Codex plugin connects to, giving the agent access to external tools and data. The url is the endpoint the agent reaches out to and plugin records which plugin declared it, both relevant when auditing what external services the agent can invoke.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"mcpServers":{"name":"mcpServers","type":"\u0019\u001bopenai.codex.mcpServer","title":"MCP servers configured across plugins","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"plugin":{"name":"plugin","type":"\u001bopenai.codex.plugin","title":"OpenAI Codex installed plugin","desc":"Plugin dropped into the Codex plugins directory, extending the agent with skills, MCP servers, and hooks. Notable fields for auditing: capabilities and skillNames describe what the plugin can do, while hasMcp and hasHooks flag whether it wires in external MCP servers or executes shell hooks, both of which widen the agent's trust boundary.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"plugins":{"name":"plugins","type":"\u0019\u001bopenai.codex.plugin","title":"Installed plugins","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional, null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bopenai.codex.skill","title":"OpenAI Codex skill","desc":"Skill defined by a SKILL.md file, giving the agent packaged instructions for a task. The name and description come from the file's YAML frontmatter, content holds the full markdown body, and plugin records which plugin supplied the skill (empty for system skills). Use sha256 to detect tampering with skill content.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bopenai.codex.skill","title":"System and plugin skills","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Installed version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"OpenAI Codex CLI instance","desc":"OpenAI Codex CLI installation on the host, exposing the `authMode` and `accountId` it is signed in with, the installed `version`, and the agent's configured surface: `plugins`, `skills`, `mcpServers`, and OAuth `connectors`. Audit which plugins, MCP servers, and connectors are configured. The `configPath` selects the configuration directory when it is not the default. URL: https://openai.com/index/introducing-codex/","min_provider_version":"13.8.2","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"openai.codex.connector":{"id":"openai.codex.connector","name":"openai.codex.connector","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connector ID, for example \"connector_...\" or \"asdk_app_...\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connector name (matches plugin name)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"plugin":{"name":"plugin","type":"\u0007","is_mandatory":true,"title":"Plugin that provides this connector","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"OpenAI Codex OAuth app connector","desc":"OAuth application connector declared by a Codex plugin, granting the agent delegated access to a third-party service. The id identifies the connected app (for example \"connector_...\" or \"asdk_app_...\") and plugin records which plugin declared it.","private":true,"min_provider_version":"13.8.2","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"openai.codex.mcpServer":{"id":"openai.codex.mcpServer","name":"openai.codex.mcpServer","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Server name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"note":{"name":"note","type":"\u0007","is_mandatory":true,"title":"Optional note describing the server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"plugin":{"name":"plugin","type":"\u0007","is_mandatory":true,"title":"Plugin that provides this MCP server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Server transport type, for example \"http\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Server endpoint URL the agent connects to","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"OpenAI Codex MCP server","desc":"Model Context Protocol server a Codex plugin connects to, giving the agent access to external tools and data. The url is the endpoint the agent reaches out to and plugin records which plugin declared it, both relevant when auditing what external services the agent can invoke.","private":true,"min_provider_version":"13.8.2","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"openai.codex.plugin":{"id":"openai.codex.plugin","name":"openai.codex.plugin","fields":{"author":{"name":"author","type":"\u0007","is_mandatory":true,"title":"Plugin author name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"capabilities":{"name":"capabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Plugin capabilities","desc":"Capability tokens declared by the plugin, for example \"Read\", \"Write\", or \"Interactive\". These indicate the level of access the plugin requests.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Plugin category","desc":"Category declared in the plugin manifest, for example \"Coding\", \"Productivity\", or \"Design\".","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Plugin description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hasHooks":{"name":"hasHooks","type":"\u0004","is_mandatory":true,"title":"Whether the plugin configures hooks (shell commands run on agent events)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hasMcp":{"name":"hasMcp","type":"\u0004","is_mandatory":true,"title":"Whether the plugin configures one or more MCP servers","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Plugin name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skillNames":{"name":"skillNames","type":"\u0019\u0007","is_mandatory":true,"title":"Names of skills bundled by the plugin","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Plugin version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"OpenAI Codex installed plugin","desc":"Plugin dropped into the Codex plugins directory, extending the agent with skills, MCP servers, and hooks. Notable fields for auditing: capabilities and skillNames describe what the plugin can do, while hasMcp and hasHooks flag whether it wires in external MCP servers or executes shell hooks, both of which widen the agent's trust boundary.","private":true,"min_provider_version":"13.8.2","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"openai.codex.skill":{"id":"openai.codex.skill","name":"openai.codex.skill","fields":{"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full markdown content of the skill definition","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"plugin":{"name":"plugin","type":"\u0007","is_mandatory":true,"title":"Plugin that provides this skill (empty for system skills)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content, for integrity checks","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"OpenAI Codex skill","desc":"Skill defined by a SKILL.md file, giving the agent packaged instructions for a task. The name and description come from the file's YAML frontmatter, content holds the full markdown body, and plugin records which plugin supplied the skill (empty for system skills). Use sha256 to detect tampering with skill content.","private":true,"min_provider_version":"13.8.2","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"openclaw":{"id":"openclaw","name":"openclaw","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the OpenClaw configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bopenclaw.skill","title":"OpenClaw skill","desc":"A single SKILL.md definition discovered for the OpenClaw agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bopenclaw.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"OpenClaw AI agent instance","desc":"OpenClaw, an AI coding agent, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .openclaw in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://openclaw.ai/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"openclaw.skill":{"id":"openclaw.skill","name":"openclaw.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"OpenClaw skill","desc":"A single SKILL.md definition discovered for the OpenClaw agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"opencode":{"id":"opencode","name":"opencode","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the OpenCode configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bopencode.skill","title":"OpenCode skill","desc":"A single SKILL.md definition discovered for the OpenCode agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bopencode.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"OpenCode AI coding assistant instance","desc":"OpenCode, an open-source terminal AI coding assistant, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .config/opencode in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://opencode.ai/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"opencode.skill":{"id":"opencode.skill","name":"opencode.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"OpenCode skill","desc":"A single SKILL.md definition discovered for the OpenCode agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"openhands":{"id":"openhands","name":"openhands","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the OpenHands configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bopenhands.skill","title":"OpenHands skill","desc":"A single SKILL.md definition discovered for the OpenHands agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bopenhands.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"OpenHands AI agent instance (formerly OpenDevin)","desc":"OpenHands (formerly OpenDevin), an open-source AI software-engineering agent, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .openhands in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://www.all-hands.dev/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"openhands.skill":{"id":"openhands.skill","name":"openhands.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"OpenHands skill","desc":"A single SKILL.md definition discovered for the OpenHands agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"os":{"id":"os","name":"os","fields":{"base":{"name":"base","type":"\u001bos.base","title":"Generic operating system information common to all platforms","desc":"Cross-platform OS view that embeds `machine` (firmware / SMBIOS hardware identity) and exposes the fields shared by every supported platform: the pretty hostname (or Windows device name), the FQDN-style hostname, environment variables and the resolved PATH list, uptime, the available-OS-update list, the reboot-pending flag, and the `users` and `groups` collections. `os.unix` and `os.linux` extend this with platform-specific surfaces.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"date":{"name":"date","type":"\u001bos.date","title":"Current date and timezone of the system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"env":{"name":"env","type":"\u001a\u0007\u0007","title":"ENV variable contents","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hostname":{"name":"hostname","type":"\u0007","title":"Hostname for this OS","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hypervisor":{"name":"hypervisor","type":"\u0007","title":"Hypervisor for this OS","min_provider_version":"11.3.35","provider":"go.mondoo.com/cnquery/v9/providers/os"},"linux":{"name":"linux","type":"\u001bos.linux","title":"Operating system information for Linux platforms","desc":"Extends `os.unix` (and through it, `os.base`) with Linux-only surfaces: the supported packet-filter stacks (`iptables`, `ip6tables`, `nftables`, `ufw`, `firewalld`), the `/etc/fstab` mount table, and the AppArmor mandatory-access-control namespace. Use it to write Linux-specific audits without reaching out to global resource handles.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"machineid":{"name":"machineid","type":"\u0007","title":"Machine ID for this OS","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Pretty hostname on macOS/Linux or device name on Windows","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0019\u0007","refs":["\"env\""],"title":"PATH variable contents","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rebootpending":{"name":"rebootpending","type":"\u0004","title":"Whether a reboot is pending","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rootCertificates":{"name":"rootCertificates","type":"\u001bos.rootCertificates","title":"Operating system root certificate trust store","desc":"X.509 root certificates that the asset's operating system trusts for TLS validation, derived from the platform-appropriate trust-store files (e.g. `/etc/ssl/certs/ca-certificates.crt` on Debian, `/etc/pki/tls/certs/ca-bundle.crt` on RHEL, the macOS SecTrust store, the Windows Root certificate store). Reads each trust-store file and exposes the parsed `network.certificate` list so audits can pin specific issuers, detect untrusted local additions, or count the trust-store size.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"unix":{"name":"unix","type":"\u001bos.unix","title":"Operating system information for Unix-like platforms","desc":"Extends `os.base` for Unix-family operating systems (macOS, Linux, FreeBSD, and similar). Aliases such as `os.base.user`, `os.base.group`, `os.base.file`, `os.base.command`, and `os.base.packages` route to concrete Unix resources, and `os.unix.sshd` aliases to the system-wide `sshd` resource so audits can express \"examine sshd on the asset\" without knowing the exact platform.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"update":{"name":"update","type":"\u001bos.update","title":"Operating system update information","desc":"Single pending OS update: its name, category, severity, whether it requires a restart, and the package format it belongs to. Read from `os.updates` to audit patch state and prioritize outstanding updates by severity.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"updates":{"name":"updates","type":"\u0019\u001bos.update","title":"List of available OS updates","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uptime":{"name":"uptime","type":"\t","title":"Current uptime","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Operating system information","desc":"Operating-system-level facts about the asset. Exposes the pretty hostname (or Windows device name), the FQDN-style hostname, the system's machine ID, the hypervisor it runs under (when virtualized), the running environment variables and the resolved PATH list, the current uptime, the list of available OS updates with their categories and severities, whether a reboot is pending after recent installs, and the current system date and timezone. The cross-platform anchor that audits start from when they need OS identity and patch state.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.base":{"id":"os.base","name":"os.base","fields":{"command":{"name":"command","type":"\u001bos.base.command","title":"Result of running a shell command on the system","desc":"Ad-hoc command execution as an MQL resource. Initialized with a shell command string; the resource executes the command through the connection (local exec, SSH, container exec, and similar) and surfaces the captured `stdout`, `stderr`, and `exitcode`. Used as a fall-back when there isn't a more specific resource for a piece of system state, and for assertions on tool versions or command-line probes.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"env":{"name":"env","type":"\u001a\u0007\u0007","title":"ENV variable contents","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bos.base.file","title":"File on the system","desc":"Single file referenced by absolute path. Surfaces the path itself, the basename and dirname, an `exists` flag, the `content` string, the file's size in bytes, an `empty` predicate, the owning `user` and `group` as references, and a structured `permissions` resource that explodes the POSIX mode into named user / group / other read / write / execute bits, the SUID / SGID / sticky bits, the `isFile` / `isDirectory` / `isSymlink` discriminators, and a printed mode string. The unit of file-level audits and the building block most config-file resources read through. Select a file by path, for example `file(\"/etc/ssh/sshd_config\")`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"group":{"name":"group","type":"\u001bos.base.group","title":"Group on the system","desc":"Single local group: numeric GID (or SID on Windows), group name, and the `members` list of users in the group. Used to audit privileged-group membership (`sudo`, `wheel`, `docker`, `adm`, and so on) and to confirm only expected accounts are present.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"groups":{"name":"groups","type":"\u001bgroups","title":"User groups","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hostname":{"name":"hostname","type":"\u0007","title":"Hostname for this OS","provider":"go.mondoo.com/cnquery/v9/providers/os"},"machine":{"name":"machine","type":"\u001bmachine","provider":"go.mondoo.com/cnquery/v9/providers/os","is_embedded":true},"name":{"name":"name","type":"\u0007","title":"Pretty Hostname on macOS/Linux or device name on Windows","provider":"go.mondoo.com/cnquery/v9/providers/os"},"packages":{"name":"packages","type":"\u001bos.base.packages","title":"All packages installed on the system","desc":"Collection of every `package` known to the asset's native package manager(s). The entry point for fleet-wide patch audits, banned-package checks, and inventory exports.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"path":{"name":"path","type":"\u0019\u0007","refs":["\"env\""],"title":"PATH variable contents","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rebootpending":{"name":"rebootpending","type":"\u0004","title":"Whether a reboot is pending","provider":"go.mondoo.com/cnquery/v9/providers/os"},"service":{"name":"service","type":"\u001bos.base.service","title":"Service on the system","desc":"Single init/service-manager unit (systemd, SysV, launchd, and others), selected by name (e.g., `service(name: \"sshd\")`). Exposes install, enable, and run state plus the unit type and mask/static metadata, so you can assert that required services run and unwanted ones stay off.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"services":{"name":"services","type":"\u001bos.base.services","title":"All services configured on the system","desc":"Collection of every service across the asset's init/service manager. Filter it to find running-but-unwanted or disabled-but-required services, e.g. `services.where(running == true)`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"updates":{"name":"updates","type":"\u0019\u001bos.update","title":"List of available OS updates","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uptime":{"name":"uptime","type":"\t","title":"Current uptime","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user":{"name":"user","type":"\u001bos.base.user","title":"User account on the system","desc":"Single local user account: numeric UID and primary GID (Windows SID where applicable), name, home directory, configured login shell, and an `enabled` flag. Surfaces the primary `group` reference, the `authorizedkeys` resource that parses the user's `~/.ssh/authorized_keys`, the SSH private keys discovered in the user's home, and a `loggedIn` predicate that reflects whether the user currently has an active session. Used for identity audits, dormant-account hygiene, and SSH-key inventories.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"users":{"name":"users","type":"\u001busers","title":"Users","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Generic operating system information common to all platforms","desc":"Cross-platform OS view that embeds `machine` (firmware / SMBIOS hardware identity) and exposes the fields shared by every supported platform: the pretty hostname (or Windows device name), the FQDN-style hostname, environment variables and the resolved PATH list, uptime, the available-OS-update list, the reboot-pending flag, and the `users` and `groups` collections. `os.unix` and `os.linux` extend this with platform-specific surfaces.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.base.command":{"id":"command","name":"command","fields":{"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Command string that was run","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exitcode":{"name":"exitcode","type":"\u0005","refs":["\"command\""],"title":"Exit code the command returned","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stderr":{"name":"stderr","type":"\u0007","refs":["\"command\""],"title":"Standard error output from running the command","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stdout":{"name":"stdout","type":"\u0007","refs":["\"command\""],"title":"Standard output from running the command","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"command","type":"\u0007"}]},"title":"Result of running a shell command on the system","desc":"Ad-hoc command execution as an MQL resource. Initialized with a shell command string; the resource executes the command through the connection (local exec, SSH, container exec, and similar) and surfaces the captured `stdout`, `stderr`, and `exitcode`. Used as a fall-back when there isn't a more specific resource for a piece of system state, and for assertions on tool versions or command-line probes.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.base.file":{"id":"file","name":"file","fields":{"basename":{"name":"basename","type":"\u0007","refs":["\"path\""],"title":"Filename without path prefix of this file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","refs":["\"path\"","\"exists\""],"title":"Contents of this file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"context":{"name":"context","type":"\u001bfile.context","title":"File context is a range of lines/columns in a file","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"dirname":{"name":"dirname","type":"\u0007","refs":["\"path\""],"title":"Path to the folder containing this file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"empty":{"name":"empty","type":"\u0004","refs":["\"path\""],"title":"Whether the path is empty","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exists":{"name":"exists","type":"\u0004","refs":["\"path\""],"title":"Whether this file exists on the system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"group":{"name":"group","type":"\u001bgroup","title":"Ownership information about the group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Location of the file on the system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"permissions":{"name":"permissions","type":"\u001bfile.permissions","refs":["\"path\""],"title":"Permissions for this file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"size":{"name":"size","type":"\u0005","refs":["\"path\""],"title":"Size of this file on disk in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user":{"name":"user","type":"\u001buser","title":"Ownership information about the user","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"File on the system","desc":"Single file referenced by absolute path. Surfaces the path itself, the basename and dirname, an `exists` flag, the `content` string, the file's size in bytes, an `empty` predicate, the owning `user` and `group` as references, and a structured `permissions` resource that explodes the POSIX mode into named user / group / other read / write / execute bits, the SUID / SGID / sticky bits, the `isFile` / `isDirectory` / `isSymlink` discriminators, and a printed mode string. The unit of file-level audits and the building block most config-file resources read through. Select a file by path, for example `file(\"/etc/ssh/sshd_config\")`.","min_provider_version":"9.0.0","defaults":"path size permissions.string","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.base.group":{"id":"group","name":"group","fields":{"gid":{"name":"gid","type":"\u0005","is_mandatory":true,"title":"Group ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"members":{"name":"members","type":"\u0019\u001buser","title":"Users who are members of this group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of this group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sid":{"name":"sid","type":"\u0007","is_mandatory":true,"title":"Group's security identifier (Windows)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"id","type":"\u0007"}]},"title":"Group on the system","desc":"Single local group: numeric GID (or SID on Windows), group name, and the `members` list of users in the group. Used to audit privileged-group membership (`sudo`, `wheel`, `docker`, `adm`, and so on) and to confirm only expected accounts are present.","min_provider_version":"9.0.0","defaults":"name gid","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.base.packages":{"id":"packages","name":"packages","fields":{"list":{"name":"list","type":"\u0019\u001bpackage","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bpackage","title":"All packages installed on the system","desc":"Collection of every `package` known to the asset's native package manager(s). The entry point for fleet-wide patch audits, banned-package checks, and inventory exports.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.base.service":{"id":"service","name":"service","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Service description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the service is enabled (start at boot)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installed":{"name":"installed","type":"\u0004","is_mandatory":true,"title":"Whether the service is installed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"masked":{"name":"masked","type":"\u0004","is_mandatory":true,"title":"Whether the service is masked (symlinked to /dev/null so it cannot start)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the service","provider":"go.mondoo.com/cnquery/v9/providers/os"},"running":{"name":"running","type":"\u0004","is_mandatory":true,"title":"Whether the service is running","provider":"go.mondoo.com/cnquery/v9/providers/os"},"static":{"name":"static","type":"\u0004","is_mandatory":true,"title":"Whether the service is static (unit file has no [Install] section and cannot be enabled/disabled)","min_provider_version":"11.8.12","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Service type (e.g., simple, forking, oneshot, notify)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Service on the system","desc":"Single init/service-manager unit (systemd, SysV, launchd, and others), selected by name (e.g., `service(name: \"sshd\")`). Exposes install, enable, and run state plus the unit type and mask/static metadata, so you can assert that required services run and unwanted ones stay off.","min_provider_version":"9.0.0","defaults":"name running enabled type","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.base.services":{"id":"services","name":"services","fields":{"list":{"name":"list","type":"\u0019\u001bservice","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bservice","title":"All services configured on the system","desc":"Collection of every service across the asset's init/service manager. Filter it to find running-but-unwanted or disabled-but-required services, e.g. `services.where(running == true)`.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.base.user":{"id":"user","name":"user","fields":{"authorizedkeys":{"name":"authorizedkeys","type":"\u001bauthorizedkeys","refs":["\"home\""],"title":"Parsed ~/.ssh/authorized_keys for this user","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the account is enabled (not locked or disabled)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"gid":{"name":"gid","type":"\u0005","is_mandatory":true,"title":"User's primary group ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"group":{"name":"group","type":"\u001bgroup","refs":["\"gid\""],"title":"The user's primary group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"home":{"name":"home","type":"\u0007","is_mandatory":true,"title":"Home directory path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"loggedIn":{"name":"loggedIn","type":"\u0004","title":"Whether the user currently has an active login session","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the user","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ntuserDat":{"name":"ntuserDat","type":"\u0007","refs":["\"home\""],"title":"Path to this user's NTUSER.DAT registry hive file (Windows)","desc":"The per-user registry hive on disk, located at `\u003chome\u003e\\NTUSER.DAT`. Pass it together with `sid` to `registrykey`/`registrykey.property` to read a user's HKCU settings even when their hive is not loaded, for example a SYSTEM scan running with no interactive session. Empty on non-Windows platforms or when the home directory is unknown.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"shell":{"name":"shell","type":"\u0007","is_mandatory":true,"title":"Login shell configured for the user (e.g., /bin/bash, /usr/sbin/nologin)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sid":{"name":"sid","type":"\u0007","is_mandatory":true,"title":"User's security identifier (Windows)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sshkeys":{"name":"sshkeys","type":"\u0019\u001bprivatekey","title":"Private SSH keys discovered in the user's home directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uid":{"name":"uid","type":"\u0005","is_mandatory":true,"title":"User ID","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"User account on the system","desc":"Single local user account: numeric UID and primary GID (Windows SID where applicable), name, home directory, configured login shell, and an `enabled` flag. Surfaces the primary `group` reference, the `authorizedkeys` resource that parses the user's `~/.ssh/authorized_keys`, the SSH private keys discovered in the user's home, and a `loggedIn` predicate that reflects whether the user currently has an active session. Used for identity audits, dormant-account hygiene, and SSH-key inventories.","min_provider_version":"9.0.0","defaults":"name uid gid","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.date":{"id":"os.date","name":"os.date","fields":{"time":{"name":"time","type":"\t","title":"Current system time","provider":"go.mondoo.com/cnquery/v9/providers/os"},"timezone":{"name":"timezone","type":"\u0007","title":"System timezone (e.g., \"America/New_York\", \"UTC\")","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Operating system date and timezone information","desc":"Current system clock time and the configured timezone string (e.g., \"America/New_York\", \"UTC\"). Used to verify that clocks are synchronized and that the correct timezone is set.","min_provider_version":"13.2.6","defaults":"time timezone","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.linux":{"id":"os.linux","name":"os.linux","fields":{"apparmor":{"name":"apparmor","type":"\u001bapparmor","title":"AppArmor mandatory access control","min_provider_version":"13.2.4","provider":"go.mondoo.com/cnquery/v9/providers/os"},"firewalld":{"name":"firewalld","type":"\u001bfirewalld","title":"firewalld dynamic firewall manager (RHEL/CentOS/Fedora)","min_provider_version":"13.2.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fstab":{"name":"fstab","type":"\u001bfstab","title":"/etc/fstab entries","min_provider_version":"11.3.5","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ip6tables":{"name":"ip6tables","type":"\u001bip6tables","title":"iptables firewall for IPv6","provider":"go.mondoo.com/cnquery/v9/providers/os"},"iptables":{"name":"iptables","type":"\u001biptables","title":"iptables firewall for IPv4","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nftables":{"name":"nftables","type":"\u001bnftables","title":"nftables firewall","min_provider_version":"11.8.14","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ufw":{"name":"ufw","type":"\u001bufw","title":"UFW (Uncomplicated Firewall)","min_provider_version":"13.2.8","provider":"go.mondoo.com/cnquery/v9/providers/os"},"unix":{"name":"unix","type":"\u001bos.unix","provider":"go.mondoo.com/cnquery/v9/providers/os","is_embedded":true}},"title":"Operating system information for Linux platforms","desc":"Extends `os.unix` (and through it, `os.base`) with Linux-only surfaces: the supported packet-filter stacks (`iptables`, `ip6tables`, `nftables`, `ufw`, `firewalld`), the `/etc/fstab` mount table, and the AppArmor mandatory-access-control namespace. Use it to write Linux-specific audits without reaching out to global resource handles.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.rootCertificates":{"id":"os.rootCertificates","name":"os.rootCertificates","fields":{"content":{"name":"content","type":"\u0019\u0007","refs":["\"files\""],"provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bfile","is_mandatory":true,"title":"List of files that define these certificates","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bcertificate","refs":["\"content\""],"provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bcertificate","title":"Operating system root certificate trust store","desc":"X.509 root certificates that the asset's operating system trusts for TLS validation, derived from the platform-appropriate trust-store files (e.g. `/etc/ssl/certs/ca-certificates.crt` on Debian, `/etc/pki/tls/certs/ca-bundle.crt` on RHEL, the macOS SecTrust store, the Windows Root certificate store). Reads each trust-store file and exposes the parsed `network.certificate` list so audits can pin specific issuers, detect untrusted local additions, or count the trust-store size.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.unix":{"id":"os.unix","name":"os.unix","fields":{"base":{"name":"base","type":"\u001bos.base","provider":"go.mondoo.com/cnquery/v9/providers/os","is_embedded":true},"sshd":{"name":"sshd","type":"\u001bos.unix.sshd","title":"OpenSSH server (sshd) namespace","desc":"Namespace hosting `sshd.config`, the entry point for auditing the OpenSSH server's effective settings and Match blocks.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"title":"Operating system information for Unix-like platforms","desc":"Extends `os.base` for Unix-family operating systems (macOS, Linux, FreeBSD, and similar). Aliases such as `os.base.user`, `os.base.group`, `os.base.file`, `os.base.command`, and `os.base.packages` route to concrete Unix resources, and `os.unix.sshd` aliases to the system-wide `sshd` resource so audits can express \"examine sshd on the asset\" without knowing the exact platform.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.unix.sshd":{"id":"sshd","name":"sshd","fields":{"config":{"name":"config","type":"\u001bsshd.config","title":"OpenSSH server (sshd) configuration","desc":"OpenSSH server settings parsed from sshd_config (and any Include files), plus the effective values reported by `sshd -T`. Surfaces `ciphers`, `macs`, `kexs`, and `hostkeyalgorithms` for cryptographic hardening checks, `permitRootLogin` for root-access policy, and `blocks` for the conditional Match blocks. Compare the configured values (`ciphers`) against the effective ones (`effectiveCiphers`) to catch overrides applied at runtime.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"title":"OpenSSH server (sshd) namespace","desc":"Namespace hosting `sshd.config`, the entry point for auditing the OpenSSH server's effective settings and Match blocks.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"os.update":{"id":"os.update","name":"os.update","fields":{"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Category of the update (e.g., \"security\", \"bugfix\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"format":{"name":"format","type":"\u0007","is_mandatory":true,"title":"Package format for this update (e.g., \"rpm\", \"deb\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the update","provider":"go.mondoo.com/cnquery/v9/providers/os"},"restart":{"name":"restart","type":"\u0004","is_mandatory":true,"title":"Whether a restart is required to complete the update","provider":"go.mondoo.com/cnquery/v9/providers/os"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Severity of the update","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Operating system update information","desc":"Single pending OS update: its name, category, severity, whether it requires a restart, and the package format it belongs to. Read from `os.updates` to audit patch state and prioritize outstanding updates by severity.","min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"id":"package","name":"package","fields":{"arch":{"name":"arch","type":"\u0007","is_mandatory":true,"title":"Architecture of this package (e.g., x86_64, arm64, noarch)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"available":{"name":"available","type":"\u0007","is_mandatory":true,"title":"Latest version the package manager reports as available","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cpes":{"name":"cpes","type":"\u0019\u001bcpe","is_mandatory":true,"title":"Common Platform Enumeration (CPE) for the package","min_provider_version":"9.1.8","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Package description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"epoch":{"name":"epoch","type":"\u0007","is_mandatory":true,"title":"Epoch of this package (version-comparison tiebreaker; empty when unset)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files this package installed on the asset","min_provider_version":"10.2.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"format":{"name":"format","type":"\u0007","is_mandatory":true,"title":"Format of this package (e.g., rpm, deb)","desc":"Empty for an abstract package synthesized from a tool install (see the `package` accessor on tool resources such as `cursor` or `claude.code`): it has no package-manager format and does not appear in `packages`.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installDate":{"name":"installDate","type":"\t","is_mandatory":true,"title":"Package install date","desc":"Time the package was installed on this asset. Populated from %{INSTALLTIME} (rpm) and the InstallDate column of the Windows Uninstall registry. Returns the zero time on backends that have no install-time source (dpkg without log parsing, apk, pacman, macOS).","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installed":{"name":"installed","type":"\u0004","is_mandatory":true,"title":"Whether the package is installed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"license":{"name":"license","type":"\u0007","title":"Package license","desc":"SPDX license expression (or upstream-reported license string). Eagerly populated where the package manager has it inline (rpm %{LICENSE}, apk APKINDEX, pacman desc); fetched on demand for dpkg (parses /usr/share/doc/\u003cpkg\u003e/copyright). Empty when no source exists (e.g. Windows registry DisplayName).","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"origin":{"name":"origin","type":"\u0007","title":"Package origin, may include version if available (optional)","desc":"Set to \"unknown\" for an abstract package synthesized from a tool install (see the `package` accessor on tool resources): the installing source could not be identified. A known origin means the package is manager-tracked and listed in `packages`.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"outdated":{"name":"outdated","type":"\u0004","title":"Whether a newer version than the installed one is available","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","is_mandatory":true,"title":"Package URL (purl) identifier for this package","min_provider_version":"9.1.6","provider":"go.mondoo.com/cnquery/v9/providers/os"},"status":{"name":"status","type":"\u0007","title":"Status of this package (e.g., if it is needed)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vendor":{"name":"vendor","type":"\u0007","is_mandatory":true,"title":"Package vendor","min_provider_version":"11.2.18","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Currently installed version of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Installed package on the platform or OS","desc":"Single package known to the asset's native package manager (rpm, deb, apk, pkg, msi, nuget, pacman, and so on). Surfaces the package name, description, currently-installed `version`, architecture, epoch, package format, install status, package URL, the CPE list mapping the package to NVD identifiers, the package origin, the latest `available` version known to the package manager, the `installed` and `outdated` flags, the file inventory the package contributed, and the package vendor. The unit of asset-level package audits and the join key for vulnerability correlation.","min_provider_version":"9.0.0","defaults":"name version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"packages":{"id":"packages","name":"packages","fields":{"list":{"name":"list","type":"\u0019\u001bpackage","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bpackage","title":"All packages installed on the system","desc":"Collection of every `package` known to the asset's native package manager(s). The entry point for fleet-wide patch audits, banned-package checks, and inventory exports.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pam":{"id":"pam","fields":{"conf":{"name":"conf","type":"\u001bpam.conf","title":"PAM (pluggable authentication module) configuration","desc":"Aggregate view of the /etc/pam.d service configuration (and the legacy single-file /etc/pam.conf). `entries` returns parsed service entries keyed by service, each carrying its type, control, and module; `modules` deduplicates the modules loaded across every service. Used to audit authentication policy, such as which services enforce `pam_faillock` or `pam_pwquality`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"module":{"name":"module","type":"\u001bpam.module","title":"PAM module aggregated view","desc":"Single PAM module viewed across every service that loads it. The `params` dict merges `key=value` options from every line that uses this module (last-write-wins per key) so audits like `pam.module(\"pam_faillock\").params[\"deny\"]` work without iterating `pam.conf.entries`. `enabled` is true when any service entry loads the module with a non-skip control.  Initialize by module name (e.g. `pam.module(name: \"pam_faillock\")`) or iterate `pam.modules` for every distinct module name seen across the parsed PAM configuration.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"pam.conf":{"id":"pam.conf","name":"pam.conf","fields":{"content":{"name":"content","type":"\u0007","refs":["\"files\""],"title":"The raw PAM configuration (across all files)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entries":{"name":"entries","type":"\u001a\u0007\u0019\u001bpam.conf.serviceEntry","refs":["\"files\""],"title":"Parsed service entries keyed by service name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exists":{"name":"exists","type":"\u0004","title":"Whether PAM configuration is present on the system","desc":"True when either the `/etc/pam.d` directory or the `/etc/pam.conf` file exists. Use it to guard PAM audits on hosts that ship no PAM configuration, such as container-optimized OS images.","min_provider_version":"13.26.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bfile","title":"List of files that make up the PAM configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modules":{"name":"modules","type":"\u0019\u001bpam.module","refs":["\"entries\""],"title":"All PAM modules loaded across every service (deduplicated by name)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"service":{"name":"service","type":"\u001bpam.conf.service","title":"PAM service configuration","desc":"PAM configuration for a single service selected by name, for example `pam.conf.service(name: \"su\")` or `pam.conf.service(name: \"sshd\")`. The service is resolved from its `/etc/pam.d/\u003cname\u003e` file, or from the lines naming it in the legacy single-file `/etc/pam.conf`. `entries` are the parsed lines for that service and `modules` aggregates the modules it loads keyed by name, so audits such as `pam.conf.service(name: \"su\").modules[\"pam_wheel\"].params[\"use_uid\"]` work without filtering `pam.conf.entries` by file path.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"serviceEntry":{"name":"serviceEntry","type":"\u001bpam.conf.serviceEntry","title":"A single entry within a PAM service configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"services":{"name":"services","type":"\u001a\u0007\u0019\u0007","refs":["\"files\""],"title":"Services configured via PAM","desc":"Deprecated in favor of `entries`, which returns parsed, structured service entries.","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"deprecated"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"PAM (pluggable authentication module) configuration","desc":"Aggregate view of the /etc/pam.d service configuration (and the legacy single-file /etc/pam.conf). `entries` returns parsed service entries keyed by service, each carrying its type, control, and module; `modules` deduplicates the modules loaded across every service. Used to audit authentication policy, such as which services enforce `pam_faillock` or `pam_pwquality`.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pam.conf.service":{"id":"pam.conf.service","name":"pam.conf.service","fields":{"entries":{"name":"entries","type":"\u0019\u001bpam.conf.serviceEntry","is_mandatory":true,"title":"Parsed entries for this service, in source order","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modules":{"name":"modules","type":"\u001a\u0007\u001bpam.module","title":"Modules loaded by this service, keyed by canonical module name","desc":"Each value aggregates every entry in this service that loads the module (last-write-wins per option), so `modules[\"pam_wheel\"].params[\"use_uid\"]` and `modules[\"pam_wheel\"].enabled` answer module-level questions without iterating `entries`.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Service name (e.g. `su`, `sshd`, `login`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path of the configuration file the service is defined in","desc":"`/etc/pam.d/\u003cname\u003e` on systems that use the pam.d directory, or `/etc/pam.conf` when the service comes from the legacy single file. Empty when no such service is configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"PAM service configuration","desc":"PAM configuration for a single service selected by name, for example `pam.conf.service(name: \"su\")` or `pam.conf.service(name: \"sshd\")`. The service is resolved from its `/etc/pam.d/\u003cname\u003e` file, or from the lines naming it in the legacy single-file `/etc/pam.conf`. `entries` are the parsed lines for that service and `modules` aggregates the modules it loads keyed by name, so audits such as `pam.conf.service(name: \"su\").modules[\"pam_wheel\"].params[\"use_uid\"]` work without filtering `pam.conf.entries` by file path.","private":true,"min_provider_version":"13.27.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pam.conf.serviceEntry":{"id":"pam.conf.serviceEntry","name":"pam.conf.serviceEntry","fields":{"control":{"name":"control","type":"\u0007","is_mandatory":true,"title":"Control field (e.g., required, requisite, sufficient, optional, or a bracketed [value=action] expression)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in service file (used for ID)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"module":{"name":"module","type":"\u0007","is_mandatory":true,"title":"PAM module used","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"Configuration options for pam service entry","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pamType":{"name":"pamType","type":"\u0007","is_mandatory":true,"title":"PAM entry type (e.g., auth, account, password, session)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"options\""],"title":"Options parsed into key/value pairs","desc":"`key=value` options become map entries (key lower-cased); bare flags such as `use_uid` map to an empty string, so `params[\"use_uid\"] != null` works as an existence check. When the same key appears more than once the last occurrence wins, matching how PAM evaluates duplicate options. The raw `options` list is retained unchanged.","min_provider_version":"13.22.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"service":{"name":"service","type":"\u0007","is_mandatory":true,"title":"Service the entry belongs to","desc":"The `/etc/pam.d/\u003cservice\u003e` file path the line came from, or the service name in the first column when read from the single-file `/etc/pam.conf`.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"A single entry within a PAM service configuration","private":true,"min_provider_version":"9.0.0","defaults":"service module","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pam.module":{"id":"pam.module","name":"pam.module","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the module is loaded by any service with a non-skip control","desc":"True when at least one service entry references this module with a control of `required`, `requisite`, `sufficient`, `optional`, or a bracketed control with `default=ok` / `success=ok`. Always false when every reference is part of a stub or commented-out line.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entries":{"name":"entries","type":"\u0019\u001bpam.conf.serviceEntry","is_mandatory":true,"title":"Every service entry that loads this module","desc":"The full list across all `/etc/pam.d/*` files, in source order. Each entry carries its originating `service`, `lineNumber`, `pamType`, `control`, and raw `options` so callers can drill back into the underlying line if `params` aggregation isn't enough.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Module name as it appears after `\u003ctype\u003e \u003ccontrol\u003e`","desc":"Examples: `pam_unix`, `pam_faillock`, `pam_pwquality`. The `.so` suffix and any leading path are stripped so lookups by short name work consistently.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All key=value options aggregated across every service entry that loads this module","desc":"The same option key appearing on multiple lines is last-write-wins in source order (matching how PAM itself evaluates duplicate flags, where the later line wins). Bare options (no `=`) are present in the map with an empty string value so `params[\"use_authtok\"] != null` works as an existence check.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"PAM module aggregated view","desc":"Single PAM module viewed across every service that loads it. The `params` dict merges `key=value` options from every line that uses this module (last-write-wins per key) so audits like `pam.module(\"pam_faillock\").params[\"deny\"]` work without iterating `pam.conf.entries`. `enabled` is true when any service entry loads the module with a non-skip control.  Initialize by module name (e.g. `pam.module(name: \"pam_faillock\")`) or iterate `pam.modules` for every distinct module name seen across the parsed PAM configuration.","private":true,"min_provider_version":"13.16.10","defaults":"name enabled entries.length","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parse":{"id":"parse","fields":{"certificates":{"name":"certificates","type":"\u001bparse.certificates","title":"Parse X.509 certificates from files","desc":"PEM-encoded certificate chains and bundles parsed into a list of `network.certificate` entries. Select the file with `parse.certificates(path: \"/etc/ssl/certs/ca-bundle.crt\")`; each resulting certificate exposes its subject, issuer, validity window, key usage, and fingerprints for trust-store and expiry audits.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"ini":{"name":"ini","type":"\u001bparse.ini","title":"Parse INI configuration files","desc":"Sections and key-value pairs parsed from any INI-formatted file. Select the file with `parse.ini(path: \"/etc/example.ini\")`; `sections` exposes a map of section name to its key-value map and `params` exposes the top-level keys that precede any section header. The key-value separator can be overridden for non-standard files.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"json":{"name":"json","type":"\u001bparse.json","title":"Parse JSON files","desc":"Parsed structure of any JSON document on disk. Select the file with `parse.json(path: \"/etc/example.json\")`; `params` holds the decoded document as a dict that MQL can traverse and filter.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"openpgp":{"name":"openpgp","type":"\u001bparse.openpgp","title":"Parse OpenPGP keys from files","desc":"OpenPGP entities (primary keys, identities, and subkeys) parsed from a key file. Select the file with `parse.openpgp(path: \"/etc/pki/rpm-gpg/RPM-GPG-KEY\")`; each entity exposes its identities and key material for validating trusted signing keys.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"plist":{"name":"plist","type":"\u001bparse.plist","title":"Parse Apple property list (plist) files","desc":"Parsed structure of an XML or binary plist file. Select the file with `parse.plist(path: \"/Library/Preferences/com.apple.example.plist\")`; `params` holds the decoded property list as a dict, so macOS preference and configuration audits can read individual keys.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"xml":{"name":"xml","type":"\u001bparse.xml","title":"Parse XML files","desc":"Parsed structure of any XML document on disk. Select the file with `parse.xml(path: \"/etc/example.xml\")`; `params` holds the decoded element tree as a dict that MQL can traverse and filter.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"yaml":{"name":"yaml","type":"\u001bparse.yaml","title":"Parse YAML files","desc":"Parsed structure of single- or multi-document YAML files. Select the file with `parse.yaml(path: \"/etc/example.yaml\")`; `params` holds the first (or only) document as a dict and `documents` holds every document in a multi-document (`---` separated) file as a `[]dict`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"parse.certificates":{"id":"parse.certificates","name":"parse.certificates","fields":{"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"Certificate file content","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","title":"Certificate file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bcertificate","refs":["\"content\"","\"path\""],"provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Certificate file path","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"list_type":"\u001bcertificate","title":"Parse X.509 certificates from files","desc":"PEM-encoded certificate chains and bundles parsed into a list of `network.certificate` entries. Select the file with `parse.certificates(path: \"/etc/ssl/certs/ca-bundle.crt\")`; each resulting certificate exposes its subject, issuer, validity window, key usage, and fingerprints for trust-store and expiry audits.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parse.ini":{"id":"parse.ini","name":"parse.ini","fields":{"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"Raw content of the file that is parsed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"delimiter":{"name":"delimiter","type":"\u0007","is_mandatory":true,"title":"Symbol that separates keys and values (defaults to \"=\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"File that is parsed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"sections\""],"title":"Key-value pairs that appear before any section header","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sections":{"name":"sections","type":"\u001a\u0007\u001a\u0007\u0007","refs":["\"content\"","\"delimiter\""],"title":"Map of section name to that section's key-value pairs","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"},{"name":"delimiter","type":"\u0007"}]},"title":"Parse INI configuration files","desc":"Sections and key-value pairs parsed from any INI-formatted file. Select the file with `parse.ini(path: \"/etc/example.ini\")`; `sections` exposes a map of section name to its key-value map and `params` exposes the top-level keys that precede any section header. The key-value separator can be overridden for non-standard files.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parse.json":{"id":"parse.json","name":"parse.json","fields":{"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"Raw content of the file that is parsed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"File that is parsed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\n","refs":["\"content\""],"title":"Decoded JSON document as a traversable dict","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"Parse JSON files","desc":"Parsed structure of any JSON document on disk. Select the file with `parse.json(path: \"/etc/example.json\")`; `params` holds the decoded document as a dict that MQL can traverse and filter.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parse.openpgp":{"id":"parse.openpgp","name":"parse.openpgp","fields":{"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"OpenPGP file content","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"OpenPGP file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bopenpgp.entity","refs":["\"content\""],"provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"list_type":"\u001bopenpgp.entity","title":"Parse OpenPGP keys from files","desc":"OpenPGP entities (primary keys, identities, and subkeys) parsed from a key file. Select the file with `parse.openpgp(path: \"/etc/pki/rpm-gpg/RPM-GPG-KEY\")`; each entity exposes its identities and key material for validating trusted signing keys.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parse.plist":{"id":"parse.plist","name":"parse.plist","fields":{"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"Raw content of the file that is parsed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"File that is parsed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\n","refs":["\"content\""],"title":"Decoded property list as a traversable dict","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"Parse Apple property list (plist) files","desc":"Parsed structure of an XML or binary plist file. Select the file with `parse.plist(path: \"/Library/Preferences/com.apple.example.plist\")`; `params` holds the decoded property list as a dict, so macOS preference and configuration audits can read individual keys.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parse.xml":{"id":"parse.xml","name":"parse.xml","fields":{"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"Raw content of the file that is parsed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"File that is parsed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\n","refs":["\"content\""],"title":"Decoded XML element tree as a traversable dict","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"Parse XML files","desc":"Parsed structure of any XML document on disk. Select the file with `parse.xml(path: \"/etc/example.xml\")`; `params` holds the decoded element tree as a dict that MQL can traverse and filter.","min_provider_version":"11.4.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parse.yaml":{"id":"parse.yaml","name":"parse.yaml","fields":{"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"Raw content of the file that is parsed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"documents":{"name":"documents","type":"\u0019\n","refs":["\"content\""],"title":"Every document in a multi-document YAML file","min_provider_version":"11.4.20","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"File that is parsed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\n","refs":["\"content\""],"title":"First (or only) YAML document as a traversable dict","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"Parse YAML files","desc":"Parsed structure of single- or multi-document YAML files. Select the file with `parse.yaml(path: \"/etc/example.yaml\")`; `params` holds the first (or only) document as a dict and `documents` holds every document in a multi-document (`---` separated) file as a `[]dict`.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"php":{"id":"php","fields":{"package":{"name":"package","type":"\u001bphp.package","title":"PHP / Composer package dependency","desc":"Single PHP package in the software inventory, exposing its unique `id`, `name` in `vendor/package` form, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the Composer files that declared it.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bphp.packages","title":"PHP / Composer package inventory","desc":"Composer packages resolved from a PHP project, covering the root project, its direct dependencies, and the full transitive dependency tree. Set `path` to point at the directory holding the Composer files.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"php.package":{"id":"php.package","name":"php.package","fields":{"cpes":{"name":"cpes","type":"\u0019\u001bcpe","title":"Common Platform Enumeration (CPE) identifiers for matching against vulnerability advisories","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Composer files that contributed this package to the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the package within the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Name of the package in vendor/package form","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl), a standardized identifier for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Resolved package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"PHP / Composer package dependency","desc":"Single PHP package in the software inventory, exposing its unique `id`, `name` in `vendor/package` form, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the Composer files that declared it.","min_provider_version":"13.10.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"php.packages":{"id":"php.packages","name":"php.packages","fields":{"directDependencies":{"name":"directDependencies","type":"\u0019\u001bphp.package","title":"List of direct dependencies","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bphp.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for Composer files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"root":{"name":"root","type":"\u001bphp.package","title":"Root project (may not exist)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bphp.package","title":"PHP / Composer package inventory","desc":"Composer packages resolved from a PHP project, covering the root project, its direct dependencies, and the full transitive dependency tree. Set `path` to point at the directory holding the Composer files.","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pi":{"id":"pi","name":"pi","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Pi configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bpi.skill","title":"Pi skill","desc":"A single SKILL.md definition discovered for the Pi agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bpi.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Pi AI agent instance","desc":"Pi, an AI coding agent, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .pi/agent in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://pi.dev/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"pi.skill":{"id":"pi.skill","name":"pi.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Pi skill","desc":"A single SKILL.md definition discovered for the Pi agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"pkgFileInfo":{"id":"pkgFileInfo","name":"pkgFileInfo","fields":{"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"File installed by a package","private":true,"min_provider_version":"10.2.0","defaults":"path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"platform":{"id":"platform","fields":{"advisories":{"name":"advisories","type":"\u001bplatform.advisories","title":"Platform and package advisories","desc":"Consolidated list of vendor advisories that affect the asset, plus a worst-case CVSS roll-up across all of them and a statistical breakdown by severity (total, critical, high, medium, low, none, unknown). Use it to drive policies that require zero outstanding critical-severity advisories or that compare an asset's advisory load against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"cves":{"name":"cves","type":"\u001bplatform.cves","title":"Platform and package CVEs","desc":"Full list of CVEs that affect the asset's installed packages or platform, plus a worst-case CVSS roll-up across them and a per-severity statistical breakdown (total, critical, high, medium, low, none, unknown). Used to enforce ceilings on outstanding critical or high-severity CVEs and to surface the most urgent fixes.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"platform.advisories":{"id":"platform.advisories","name":"platform.advisories","fields":{"cvss":{"name":"cvss","type":"\u001baudit.cvss","title":"Worst CVSS score for all advisories","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001baudit.advisory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stats":{"name":"stats","type":"\n","title":"Statistical information: total, critical, high, medium, low, none, unknown","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001baudit.advisory","title":"Platform and package advisories","desc":"Consolidated list of vendor advisories that affect the asset, plus a worst-case CVSS roll-up across all of them and a statistical breakdown by severity (total, critical, high, medium, low, none, unknown). Use it to drive policies that require zero outstanding critical-severity advisories or that compare an asset's advisory load against a baseline.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"platform.cves":{"id":"platform.cves","name":"platform.cves","fields":{"cvss":{"name":"cvss","type":"\u001baudit.cvss","title":"Worst CVSS score for all CVEs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001baudit.cve","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stats":{"name":"stats","type":"\n","title":"Statistical information: total, critical, high, medium, low, none, unknown","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001baudit.cve","title":"Platform and package CVEs","desc":"Full list of CVEs that affect the asset's installed packages or platform, plus a worst-case CVSS roll-up across them and a per-severity statistical breakdown (total, critical, high, medium, low, none, unknown). Used to enforce ceilings on outstanding critical or high-severity CVEs and to surface the most urgent fixes.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"port":{"id":"port","name":"port","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Local address of this port","provider":"go.mondoo.com/cnquery/v9/providers/os"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Port number","provider":"go.mondoo.com/cnquery/v9/providers/os"},"process":{"name":"process","type":"\u001bprocess","title":"Process that is connected to this port","provider":"go.mondoo.com/cnquery/v9/providers/os"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol of this port","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remoteAddress":{"name":"remoteAddress","type":"\u0007","is_mandatory":true,"title":"Remote address connected to this port","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remotePort":{"name":"remotePort","type":"\u0005","is_mandatory":true,"title":"Remote port connected to this port","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"State of this open port","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tls":{"name":"tls","type":"\u001btls","refs":["\"address\"","\"port\"","\"protocol\""],"title":"TLS on this port, if it is available","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user":{"name":"user","type":"\u001buser","is_mandatory":true,"title":"User configured for this port","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Single TCP/UDP port on the system","desc":"Single network socket: its protocol, local address and port, connection state, and (where the OS reports it) the owning process and the remote peer. The `state` field distinguishes listening sockets from established connections, `process` links to the program holding the socket, and `tls` probes the endpoint for a TLS configuration. Central to exposure audits, for example finding listening ports bound to a non-loopback address.","min_provider_version":"9.0.1","defaults":"port protocol address process.executable","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ports":{"id":"ports","name":"ports","fields":{"list":{"name":"list","type":"\u0019\u001bport","provider":"go.mondoo.com/cnquery/v9/providers/os"},"listening":{"name":"listening","type":"\u0019\u001bport","title":"All listening ports","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bport","title":"All TCP/UDP ports on the system","desc":"Collection of all network sockets, both listening and connected. The `listening` accessor narrows the set to sockets in the listen state, which is the usual starting point for an exposure audit (for example `ports.listening.where(address != \"127.0.0.1\")`).","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"postfix":{"id":"postfix","name":"postfix","fields":{"inetInterfaces":{"name":"inetInterfaces","type":"\u0019\u0007","title":"Interfaces Postfix listens on, parsed from the inet_interfaces parameter","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mainCfPath":{"name":"mainCfPath","type":"\u0007","title":"Path to the Postfix main.cf configuration file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"masterCfPath":{"name":"masterCfPath","type":"\u0007","title":"Path to the Postfix master.cf configuration file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","title":"Effective Postfix parameters","desc":"Reported by `postconf` when available (so parameters left at their built-in default still appear); otherwise parsed from main.cf, in which case only values written to the file are present.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"service":{"name":"service","type":"\u001bpostfix.service","title":"Postfix master.cf service definition","desc":"Single daemon entry from the Postfix master.cf file: its service name and transport type, the chroot and privilege flags, the wake-up and process limits, and the command it runs. The flag columns carry `y`, `n`, or `-` (use the built-in default). Iterated from `postfix.services`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"services":{"name":"services","type":"\u0019\u001bpostfix.service","title":"Service definitions from master.cf","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"Postfix mail transfer agent configuration","desc":"Effective Postfix configuration. `params` reports parameter values from `postconf` when the binary is available (which includes the built-in defaults for parameters not written to the file) and otherwise falls back to parsing main.cf directly (file values only, with `$name` interpolation and continuation lines). `inetInterfaces` is the parsed `inet_interfaces` list and `services` are the daemon definitions from master.cf. By default the per-distribution config locations are used; select an alternate main.cf with `postfix(\"/path/to/main.cf\")`.","min_provider_version":"13.22.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"postfix.service":{"id":"postfix.service","name":"postfix.service","fields":{"chroot":{"name":"chroot","type":"\u0007","is_mandatory":true,"title":"Whether the service runs chrooted (chroot column: y, n, or -)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Command, with arguments, that the service runs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"maxProcesses":{"name":"maxProcesses","type":"\u0007","is_mandatory":true,"title":"Maximum number of processes, or - for the default (maxproc column)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"private":{"name":"private","type":"\u0007","is_mandatory":true,"title":"Whether access is restricted to the mail system (private column: y, n, or -)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"service":{"name":"service","type":"\u0007","is_mandatory":true,"title":"Service name (first column; a port number, socket name, or path)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Transport type (inet, unix, unix-dgram, fifo, or pass)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"unprivileged":{"name":"unprivileged","type":"\u0007","is_mandatory":true,"title":"Whether the service runs unprivileged (unpriv column: y, n, or -)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"wakeup":{"name":"wakeup","type":"\u0007","is_mandatory":true,"title":"Wake-up interval, or - for none (wakeup column)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Postfix master.cf service definition","desc":"Single daemon entry from the Postfix master.cf file: its service name and transport type, the chroot and privilege flags, the wake-up and process limits, and the command it runs. The flag columns carry `y`, `n`, or `-` (use the built-in default). Iterated from `postfix.services`.","private":true,"min_provider_version":"13.22.2","defaults":"service type command","provider":"go.mondoo.com/cnquery/v9/providers/os"},"powershell":{"id":"powershell","name":"powershell","fields":{"exitcode":{"name":"exitcode","type":"\u0005","title":"Exit code the script returned","provider":"go.mondoo.com/cnquery/v9/providers/os"},"script":{"name":"script","type":"\u0007","is_mandatory":true,"title":"Script string that was run","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stderr":{"name":"stderr","type":"\u0007","title":"Standard error output from running the script","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stdout":{"name":"stdout","type":"\u0007","title":"Standard output from running the script","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"script","type":"\u0007"}]},"title":"Result of running a PowerShell script on the system","desc":"Ad-hoc PowerShell execution as an MQL resource. Initialized with a script string; the resource executes the script via PowerShell on the asset and surfaces the captured `stdout`, `stderr`, and `exitcode`. The Windows and cross-platform-PowerShell counterpart to `command` for assertions that need PowerShell-only surface area.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"privatekey":{"id":"privatekey","name":"privatekey","fields":{"encrypted":{"name":"encrypted","type":"\u0004","is_mandatory":true,"title":"Whether the key material is passphrase-encrypted","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"File on disk for this private key","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the private key file","desc":"Deprecated in favor of the `file` field.","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"deprecated"},"pem":{"name":"pem","type":"\u0007","is_mandatory":true,"title":"PEM data","provider":"go.mondoo.com/cnquery/v9/providers/os"},"publicKeyAlgorithm":{"name":"publicKeyAlgorithm","type":"\u0007","title":"Public key algorithm of the key material (e.g., RSA, ECDSA, Ed25519, DSA)","min_provider_version":"13.34.4","provider":"go.mondoo.com/cnquery/v9/providers/os"},"publicKeyBits":{"name":"publicKeyBits","type":"\u0005","title":"Key size in bits (e.g., 2048, 256, 384, 521)","min_provider_version":"13.34.4","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Private key on disk","desc":"PEM-encoded private key file: the `file` reference, the raw PEM `pem` payload, and an `encrypted` flag indicating whether the key is passphrase-protected. `publicKeyAlgorithm` and `publicKeyBits` describe the key material. Used to inventory SSH or service-account keys discovered on the asset and to flag unencrypted private keys stored in user home directories.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"process":{"id":"process","name":"process","fields":{"command":{"name":"command","type":"\u0007","title":"Full command used to run this process","provider":"go.mondoo.com/cnquery/v9/providers/os"},"executable":{"name":"executable","type":"\u0007","title":"Executable that is running this process","provider":"go.mondoo.com/cnquery/v9/providers/os"},"flags":{"name":"flags","type":"\u001a\u0007\u0007","title":"Map of additional flags","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pid":{"name":"pid","type":"\u0005","is_mandatory":true,"title":"PID (process ID)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0007","title":"State of the process (i.e., sleeping, running, etc)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"pid","type":"\u0005"}]},"title":"Single process on the system","desc":"Running process identified by its PID. Exposes the executable path, the full command line it was invoked with, its current state, and a map of additional per-process flags. Select a process with `process(pid: 1)`.","min_provider_version":"9.0.1","defaults":"executable pid state","provider":"go.mondoo.com/cnquery/v9/providers/os"},"processes":{"id":"processes","name":"processes","fields":{"list":{"name":"list","type":"\u0019\u001bprocess","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bprocess","title":"All processes running on the system","desc":"Collection of every running process, for filtering by executable, command line, user, or state. For example `processes.where(executable == \"/usr/sbin/sshd\")` finds all instances of a daemon, or filter on state to spot zombie or stopped processes.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"prolog":{"id":"prolog","fields":{"package":{"name":"package","type":"\u001bprolog.package","title":"SWI-Prolog pack","desc":"Single SWI-Prolog add-on pack installed under the pack directory, keyed by a unique `id`. Exposes the pack `name`, `version`, a `purl` (Package URL) for SBOM and vulnerability matching, and the `files` that make up the pack. Useful for inventorying add-on libraries on SWI-Prolog hosts.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bprolog.packages","title":"SWI-Prolog pack inventory","desc":"SWI-Prolog packs installed on the host, each with its version. Set `path` to the directory holding the installed packs.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"prolog.package":{"id":"prolog.package","name":"prolog.package","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files that make up the pack","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the pack","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Pack name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl) identifying the pack for SBOM and vulnerability matching","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Pack version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"SWI-Prolog pack","desc":"Single SWI-Prolog add-on pack installed under the pack directory, keyed by a unique `id`. Exposes the pack `name`, `version`, a `purl` (Package URL) for SBOM and vulnerability matching, and the `files` that make up the pack. Useful for inventorying add-on libraries on SWI-Prolog hosts.","min_provider_version":"13.13.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"prolog.packages":{"id":"prolog.packages","name":"prolog.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bprolog.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for SWI-Prolog packs directory","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bprolog.package","title":"SWI-Prolog pack inventory","desc":"SWI-Prolog packs installed on the host, each with its version. Set `path` to the directory holding the installed packs.","min_provider_version":"13.13.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"python":{"id":"python","name":"python","fields":{"package":{"name":"package","type":"\u001bpython.package","title":"Python package information","desc":"A single installed Python package: name, version, license, author, summary, required Python version, project URLs, package URL (`purl`), CPEs, and the full transitive `dependencies` list. Used to inventory Python dependencies and correlate them with vulnerability data.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u0019\u001bpython.package","title":"List of all discovered packages","min_provider_version":"11.4.86","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to a specific site-packages location to exclusively scan (empty means scan default locations)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"toplevel":{"name":"toplevel","type":"\u0019\u001bpython.package","title":"List of all packages that were specifically installed (i.e., not auto-installed as a dependency)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"Python package inventory","desc":"Installed Python packages discovered on the host. `packages` lists every package found and `toplevel` narrows that to packages that were explicitly installed rather than pulled in as dependencies. Pass `path` to scan a specific site-packages location instead of the default locations. Used for software inventory and vulnerability correlation.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"python.package":{"id":"python.package","name":"python.package","fields":{"author":{"name":"author","type":"\u0007","is_mandatory":true,"title":"Author of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"authorEmail":{"name":"authorEmail","type":"\u0007","is_mandatory":true,"title":"Author email of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cpes":{"name":"cpes","type":"\u0019\u001bcpe","is_mandatory":true,"title":"Common Platform Enumeration (CPE) for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dependencies":{"name":"dependencies","type":"\u0019\u001bpython.package","title":"List of packages depended on","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"File containing the package metadata","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID is the python.package unique identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"license":{"name":"license","type":"\u0007","is_mandatory":true,"title":"License of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"projectUrls":{"name":"projectUrls","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Project URLs by label (e.g., Homepage, Repository, Documentation)","min_provider_version":"11.8.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","is_mandatory":true,"title":"Package URL","provider":"go.mondoo.com/cnquery/v9/providers/os"},"requiresPython":{"name":"requiresPython","type":"\u0007","is_mandatory":true,"title":"Required Python version (e.g., \"\u003e=3.6\")","min_provider_version":"11.8.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"summary":{"name":"summary","type":"\u0007","is_mandatory":true,"title":"Short package description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Version of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"Python package information","desc":"A single installed Python package: name, version, license, author, summary, required Python version, project URLs, package URL (`purl`), CPEs, and the full transitive `dependencies` list. Used to inventory Python dependencies and correlate them with vulnerability data.","min_provider_version":"9.0.1","defaults":"name version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"qwen":{"id":"qwen","fields":{"code":{"name":"code","type":"\u001bqwen.code","title":"Qwen Code (Alibaba) instance","desc":"Qwen Code, Alibaba's AI coding assistant, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .qwen in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://qwen.ai/qwencode","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"}},"is_extension":true},"qwen.code":{"id":"qwen.code","name":"qwen.code","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Qwen Code configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bqwen.code.skill","title":"Qwen Code skill","desc":"A single SKILL.md definition discovered for the Qwen Code agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bqwen.code.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Qwen Code (Alibaba) instance","desc":"Qwen Code, Alibaba's AI coding assistant, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .qwen in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://qwen.ai/qwencode","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"qwen.code.skill":{"id":"qwen.code.skill","name":"qwen.code.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Qwen Code skill","desc":"A single SKILL.md definition discovered for the Qwen Code agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"r":{"id":"r","fields":{"package":{"name":"package","type":"\u001br.package","title":"R package","desc":"Single R package resolved from `renv.lock`, with its `name`, locked `version`, and a `purl` (Package URL) for SBOM and vulnerability matching, plus the `files` that declared it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001br.packages","title":"R package inventory","desc":"Locked R packages read from `renv.lock` with their resolved versions. With no `path` set, scans common app and per-user paths (`/usr/src/app`, `/home/*/app`, `/home/*`); pass `path` to target a specific project directory or `renv.lock` file. Each entry carries a `purl` for SBOM and vulnerability matching.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"r.package":{"id":"r.package","name":"r.package","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files that declared the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Package name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl) identifying the package for SBOM and vulnerability matching","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Resolved package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"R package","desc":"Single R package resolved from `renv.lock`, with its `name`, locked `version`, and a `purl` (Package URL) for SBOM and vulnerability matching, plus the `files` that declared it.","private":true,"min_provider_version":"13.15.2","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"r.packages":{"id":"r.packages","name":"r.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Lock files used to build the package list","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001br.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Filesystem path searched for renv.lock (empty scans the default paths)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001br.package","title":"R package inventory","desc":"Locked R packages read from `renv.lock` with their resolved versions. With no `path` set, scans common app and per-user paths (`/usr/src/app`, `/home/*/app`, `/home/*`); pass `path` to target a specific project directory or `renv.lock` file. Each entry carries a `purl` for SBOM and vulnerability matching.","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"registrykey":{"id":"registrykey","name":"registrykey","fields":{"children":{"name":"children","type":"\u0019\u0007","title":"Names of the immediate child keys under this key","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exists":{"name":"exists","type":"\u0004","title":"Whether the registry key exists","provider":"go.mondoo.com/cnquery/v9/providers/os"},"items":{"name":"items","type":"\u0019\u001bregistrykey.property","title":"Value entries in this registry key","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ntuserDat":{"name":"ntuserDat","type":"\u0007","is_mandatory":true,"title":"Path to the user's NTUSER.DAT hive file","desc":"Optional. Used with `userSid` to read a user's registry when their hive is not currently loaded, for example a SYSTEM scan running with no interactive session. Typically populated from `user.ntuserDat`.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Registry key path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"properties":{"name":"properties","type":"\u001a\u0007\u0007","title":"Properties of the registry key as a name-to-value map","desc":"Deprecated in favor of `items`, which returns structured property entries.","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"deprecated"},"property":{"name":"property","type":"\u001bregistrykey.property","title":"Windows registry key property","desc":"A single named value within a registry key: the key `path`, value `name`, whether it `exists`, the registry `type` (for example `REG_SZ`, `REG_DWORD`, `REG_BINARY`, or `REG_MULTI_SZ`), and the parsed `data`. Select a specific value by path and name, or iterate from `registrykey.items`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"userSid":{"name":"userSid","type":"\u0007","is_mandatory":true,"title":"SID of the user whose registry hive to read","desc":"Optional. When set, `path` is interpreted relative to that user's per-user registry (HKCU): the loaded `HKEY_USERS\\\u003csid\u003e` hive when the user is logged in, otherwise the profile's `NTUSER.DAT` (see `ntuserDat`) loaded on demand. Leave empty to treat `path` as an absolute registry path.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"},{"name":"userSid","type":"\u0007","optional":true},{"name":"ntuserDat","type":"\u0007","optional":true}]},"title":"Windows registry key","desc":"A Windows registry key selected by `path`, exposing its value entries (`items`), child key names (`children`), and whether the key `exists`. Optionally read a specific user's per-user registry (HKCU) by supplying `userSid`, falling back to their `NTUSER.DAT` profile hive (`ntuserDat`) when that hive is not currently loaded. Select a key with `registrykey(path: \"...\")`.","min_provider_version":"9.0.1","defaults":"path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"registrykey.property":{"id":"registrykey.property","name":"registrykey.property","fields":{"data":{"name":"data","type":"\n","title":"Parsed registry value data","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exists":{"name":"exists","type":"\u0004","title":"Whether the property exists","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Registry value name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ntuserDat":{"name":"ntuserDat","type":"\u0007","is_mandatory":true,"title":"Path to the user's NTUSER.DAT hive file","desc":"Optional. Forwarded to the underlying `registrykey`. See `registrykey.ntuserDat`.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Registry key path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","title":"Registry value type (e.g., REG_SZ, REG_DWORD, REG_BINARY)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"userSid":{"name":"userSid","type":"\u0007","is_mandatory":true,"title":"SID of the user whose registry hive to read","desc":"Optional. Forwarded to the underlying `registrykey` so `path` resolves against that user's per-user registry (HKCU). See `registrykey.userSid`.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"value":{"name":"value","type":"\u0007","title":"Registry property value as a string","desc":"Deprecated in favor of `data`, the parsed structured value.","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"deprecated"}},"init":{"args":[{"name":"path","type":"\u0007"},{"name":"name","type":"\u0007"},{"name":"userSid","type":"\u0007","optional":true},{"name":"ntuserDat","type":"\u0007","optional":true}]},"title":"Windows registry key property","desc":"A single named value within a registry key: the key `path`, value `name`, whether it `exists`, the registry `type` (for example `REG_SZ`, `REG_DWORD`, `REG_BINARY`, or `REG_MULTI_SZ`), and the parsed `data`. Select a specific value by path and name, or iterate from `registrykey.items`.","min_provider_version":"9.0.1","defaults":"path name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"roo":{"id":"roo","name":"roo","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Roo Code configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional, null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001broo.skill","title":"Roo Code skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the agent. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001broo.skill","title":"Installed skills","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Roo Code editor instance","desc":"Roo Code AI coding agent installed on the host. Queryable through it are the installed skills, along with the package that installed the tool and the runtime it executes in. URL: https://roocode.com/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"roo.skill":{"id":"roo.skill","name":"roo.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint describing the skill's expected arguments","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full markdown content of the skill definition","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content, for integrity checks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Roo Code skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the agent. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"rsyslog":{"id":"rsyslog","fields":{"action":{"name":"action","type":"\u001brsyslog.action","title":"rsyslog output action","desc":"Destination where rsyslog ships matched log lines. Surfaces both modern `action(type=\"omfwd\" target=\"…\" …)` statements and the legacy selector-with-target form (e.g. `*.* @@host:514`). When this action came from a legacy selector, the `parameters` dict is empty and `target` / `protocol` / `tlsEnabled` are derived from the target token's syntax. Use it to confirm that remote forwarding uses TCP with TLS rather than plaintext UDP.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"conf":{"name":"conf","type":"\u001brsyslog.conf","title":"rsyslog daemon configuration","desc":"Effective settings across the main file and included fragments. The `modules`, `inputs`, `actions`, and `rules` fields parse the configuration into structured form so audits can assert on individual statements without regex over raw text. Each entry carries `sourceFile` and `sourceLine` so findings can point back at the fragment that introduced the directive.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"input":{"name":"input","type":"\u001brsyslog.input","title":"rsyslog input source","desc":"Configured input, the module instance that pulls log lines into rsyslog. Surfaces both legacy single-directive forms (e.g. `$InputTCPServerRun 514`) and modern RainerScript blocks (`input(type=\"imtcp\" port=\"514\" ruleset=\"…\")`). Use it to audit which listeners are open, on what ports and addresses, and whether network inputs accept TLS.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"module":{"name":"module","type":"\u001brsyslog.module","title":"rsyslog loaded module","desc":"Single module load: modern `module(load=\"imtcp\" KeepAlive=\"on\")` or legacy `$ModLoad imtcp`. Modern declarations carry their full parameter dict; legacy declarations carry only the module name (parameters is empty). The module name follows rsyslog conventions: `im*` for inputs, `om*` for outputs, `mm*` for message modifications, `pm*` for parsers.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"rule":{"name":"rule","type":"\u001brsyslog.rule","title":"rsyslog selector rule","desc":"Legacy `\u003cfacility\u003e.\u003cseverity\u003e \u003ctarget\u003e` routing rule, the form that ships in every default rsyslog config. Modern `if … then … { action(…) }` conditionals are not surfaced here; their actions are available via `rsyslog.conf.actions` only.  Selector grammar covered: - Simple: `auth.info /var/log/auth.log` - Facility list: `auth,authpriv.* /var/log/auth.log` - Multi-selector: `*.info;mail.none;authpriv.none /var/log/messages` (each selector becomes its own rule) - Negation: `auth,authpriv.none` → `negate = true` - Wildcards: `*.*` and `auth.*`","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"rsyslog.action":{"id":"rsyslog.action","name":"rsyslog.action","fields":{"parameters":{"name":"parameters","type":"\n","is_mandatory":true,"title":"All parameters as a dict","desc":"Modern actions carry every key/value pair other than `type` and `target` here. Legacy selector-derived actions carry an empty dict.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Transport protocol for network actions: `\"tcp\"`, `\"udp\"`, or empty","provider":"go.mondoo.com/cnquery/v9/providers/os"},"queue":{"name":"queue","type":"\n","is_mandatory":true,"title":"Action-level queue configuration, empty when no queue is configured","desc":"Carries the modern `queue.*` parameters as `{type, filename, size, saveOnShutdown, ...}` (the exact key set depends on the queue type).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sourceFile":{"name":"sourceFile","type":"\u0007","is_mandatory":true,"title":"Absolute path of the file this directive was read from","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sourceLine":{"name":"sourceLine","type":"\u0005","is_mandatory":true,"title":"1-indexed line number within sourceFile","provider":"go.mondoo.com/cnquery/v9/providers/os"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"Destination of the action","desc":"For omfile a filesystem path; for omfwd a `host` or `host:port`; for omusrmsg a comma-separated user list (or `*` for wall); for omhttp / omkafka the relevant URL or broker list.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"template":{"name":"template","type":"\u0007","is_mandatory":true,"title":"Template name applied to messages, empty when the default is used","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tlsEnabled":{"name":"tlsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether TLS is configured for this action","desc":"True when the modern form sets `StreamDriverMode=\"1\"` (or equivalent per-driver settings). False for legacy selector forms, which rely on the `$DefaultNetstreamDriver` / `$ActionSendStreamDriverMode` globals.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Action module type (e.g. omfwd, omfile, omusrmsg, omhttp, omkafka)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"rsyslog output action","desc":"Destination where rsyslog ships matched log lines. Surfaces both modern `action(type=\"omfwd\" target=\"…\" …)` statements and the legacy selector-with-target form (e.g. `*.* @@host:514`). When this action came from a legacy selector, the `parameters` dict is empty and `target` / `protocol` / `tlsEnabled` are derived from the target token's syntax. Use it to confirm that remote forwarding uses TCP with TLS rather than plaintext UDP.","private":true,"min_provider_version":"13.16.10","defaults":"type target sourceFile","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rsyslog.conf":{"id":"rsyslog.conf","name":"rsyslog.conf","fields":{"actions":{"name":"actions","type":"\u0019\u001brsyslog.action","refs":["\"files\""],"title":"Configured output actions (modern action() and legacy selector-with-target rules)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","refs":["\"files\""],"title":"Raw contents of this rsyslog service configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bfile","refs":["\"path\""],"title":"Files that make up this rsyslog service configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inputs":{"name":"inputs","type":"\u0019\u001brsyslog.input","refs":["\"files\""],"title":"Configured inputs (modern input() and legacy $Input* directives)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modules":{"name":"modules","type":"\u0019\u001brsyslog.module","refs":["\"files\""],"title":"Loaded modules (modern module() and legacy $ModLoad)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"content\""],"title":"Legacy `$Directive value` settings parsed into key/value pairs","desc":"The leading `$` is stripped from each key and the value is trimmed of surrounding whitespace, so `params[\"FileCreateMode\"] == \"0640\"` works regardless of the spacing used in the file. When the same directive appears more than once the last occurrence wins. The raw `settings` list is retained unchanged.","min_provider_version":"13.22.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","title":"Path for the main rsyslog file and search","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rules":{"name":"rules","type":"\u0019\u001brsyslog.rule","refs":["\"files\""],"title":"Legacy selector-based routing rules (facility.severity → target)","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"settings":{"name":"settings","type":"\u0019\u0007","refs":["\"content\""],"title":"List of settings for this rsyslog service","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"rsyslog daemon configuration","desc":"Effective settings across the main file and included fragments. The `modules`, `inputs`, `actions`, and `rules` fields parse the configuration into structured form so audits can assert on individual statements without regex over raw text. Each entry carries `sourceFile` and `sourceLine` so findings can point back at the fragment that introduced the directive.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rsyslog.input":{"id":"rsyslog.input","name":"rsyslog.input","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Listen address for network inputs, empty when not applicable","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parameters":{"name":"parameters","type":"\n","is_mandatory":true,"title":"All parameters as a dict, in source representation","provider":"go.mondoo.com/cnquery/v9/providers/os"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Listen port for network inputs, 0 when not applicable","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ruleset":{"name":"ruleset","type":"\u0007","is_mandatory":true,"title":"Ruleset this input feeds into, empty for the default ruleset","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sourceFile":{"name":"sourceFile","type":"\u0007","is_mandatory":true,"title":"Absolute path of the file this directive was read from","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sourceLine":{"name":"sourceLine","type":"\u0005","is_mandatory":true,"title":"1-indexed line number within sourceFile","provider":"go.mondoo.com/cnquery/v9/providers/os"},"streamDriverMode":{"name":"streamDriverMode","type":"\u0007","is_mandatory":true,"title":"TLS stream-driver mode reported by the input","desc":"`\"1\"` indicates the input accepts TLS connections (paired with a `$DefaultNetstreamDriver gtls` global or per-input `StreamDriverMode=\"1\"`). `\"0\"` or empty indicates plaintext.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Input module type (e.g. imtcp, imudp, imuxsock, imfile)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"rsyslog input source","desc":"Configured input, the module instance that pulls log lines into rsyslog. Surfaces both legacy single-directive forms (e.g. `$InputTCPServerRun 514`) and modern RainerScript blocks (`input(type=\"imtcp\" port=\"514\" ruleset=\"…\")`). Use it to audit which listeners are open, on what ports and addresses, and whether network inputs accept TLS.","private":true,"min_provider_version":"13.16.10","defaults":"type port sourceFile","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rsyslog.module":{"id":"rsyslog.module","name":"rsyslog.module","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Module name (e.g. imtcp, imuxsock, omfwd, mmnormalize)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parameters":{"name":"parameters","type":"\n","is_mandatory":true,"title":"Module-load parameters as a dict (empty for legacy $ModLoad)","desc":"Modern `module(load=\"X\" key1=\"v1\" key2=\"v2\")` declarations carry every key/value pair other than `load` here. Boolean-like values are kept as strings to preserve the source representation (`\"on\"` vs `true`).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sourceFile":{"name":"sourceFile","type":"\u0007","is_mandatory":true,"title":"Absolute path of the file this directive was read from","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sourceLine":{"name":"sourceLine","type":"\u0005","is_mandatory":true,"title":"1-indexed line number within sourceFile","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"rsyslog loaded module","desc":"Single module load: modern `module(load=\"imtcp\" KeepAlive=\"on\")` or legacy `$ModLoad imtcp`. Modern declarations carry their full parameter dict; legacy declarations carry only the module name (parameters is empty). The module name follows rsyslog conventions: `im*` for inputs, `om*` for outputs, `mm*` for message modifications, `pm*` for parsers.","private":true,"min_provider_version":"13.16.10","defaults":"name sourceFile","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rsyslog.rule":{"id":"rsyslog.rule","name":"rsyslog.rule","fields":{"action":{"name":"action","type":"\u001brsyslog.action","title":"Resolved action for this rule","desc":"Constructed from `target`: file-path → omfile, `@host` → omfwd/udp, `@@host` → omfwd/tcp, `:omusrmsg:*` → omusrmsg, `~` → discard, `|name` → ompipe. Legacy rules have no TLS information, so the action's `tlsEnabled` is always false.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"facilities":{"name":"facilities","type":"\u0019\u0007","is_mandatory":true,"title":"Facilities matched (e.g. `[\"auth\", \"authpriv\"]`, or `[\"*\"]`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"negate":{"name":"negate","type":"\u0004","is_mandatory":true,"title":"Whether the severity is the negation marker (`.none`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"severities":{"name":"severities","type":"\u0019\u0007","is_mandatory":true,"title":"Severities matched","desc":"For example `[\"info\"]`, `[\"*\"]`, or `[\"none\"]` (negation form).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sourceFile":{"name":"sourceFile","type":"\u0007","is_mandatory":true,"title":"Absolute path of the file this directive was read from","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sourceLine":{"name":"sourceLine","type":"\u0005","is_mandatory":true,"title":"1-indexed line number within sourceFile","provider":"go.mondoo.com/cnquery/v9/providers/os"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"Raw target token from the rule","desc":"File path, `@host`, `@@host:port`, `:omusrmsg:user`, `~` (discard), `|fifo`, etc.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"rsyslog selector rule","desc":"Legacy `\u003cfacility\u003e.\u003cseverity\u003e \u003ctarget\u003e` routing rule, the form that ships in every default rsyslog config. Modern `if … then … { action(…) }` conditionals are not surfaced here; their actions are available via `rsyslog.conf.actions` only.  Selector grammar covered: - Simple: `auth.info /var/log/auth.log` - Facility list: `auth,authpriv.* /var/log/auth.log` - Multi-selector: `*.info;mail.none;authpriv.none /var/log/messages` (each selector becomes its own rule) - Negation: `auth,authpriv.none` → `negate = true` - Wildcards: `*.*` and `auth.*`","private":true,"min_provider_version":"13.16.10","defaults":"facilities severities target sourceFile","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ruby":{"id":"ruby","fields":{"package":{"name":"package","type":"\u001bruby.package","title":"Ruby gem package","desc":"Single Ruby gem in the software inventory, exposing its unique `id`, gem `name`, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the lock files that declared it.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bruby.packages","title":"Ruby gem inventory","desc":"Ruby gems resolved from a project's Gemfile.lock, covering the root project, its direct dependencies, and the full transitive dependency tree. Set `path` to the directory holding the Gemfile.lock.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"ruby.package":{"id":"ruby.package","name":"ruby.package","fields":{"cpes":{"name":"cpes","type":"\u0019\u001bcpe","title":"Common Platform Enumeration (CPE) identifiers for matching against vulnerability advisories","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Lock files that contributed this gem to the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the gem within the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Gem name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl), a standardized identifier for the gem","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Resolved gem version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Ruby gem package","desc":"Single Ruby gem in the software inventory, exposing its unique `id`, gem `name`, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the lock files that declared it.","min_provider_version":"13.12.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ruby.packages":{"id":"ruby.packages","name":"ruby.packages","fields":{"directDependencies":{"name":"directDependencies","type":"\u0019\u001bruby.package","title":"List of direct dependencies","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bruby.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for Gemfile.lock","provider":"go.mondoo.com/cnquery/v9/providers/os"},"root":{"name":"root","type":"\u001bruby.package","title":"Root project (may not exist)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bruby.package","title":"Ruby gem inventory","desc":"Ruby gems resolved from a project's Gemfile.lock, covering the root project, its direct dependencies, and the full transitive dependency tree. Set `path` to the directory holding the Gemfile.lock.","min_provider_version":"13.12.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rust":{"id":"rust","fields":{"package":{"name":"package","type":"\u001brust.package","title":"Rust/Cargo crate dependency","desc":"Single Rust crate in the software inventory, exposing its unique `id`, crate `name`, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the manifest or lock files that declared it.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001brust.packages","title":"Rust/Cargo crate inventory","desc":"Rust crates discovered from Cargo sources: the `root` crate, the `directDependencies`, and the full transitive tree (iterated from the list itself). Parsed from Cargo manifests and lockfiles. Pass `path` to point at a specific project.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"rust.package":{"id":"rust.package","name":"rust.package","fields":{"cpes":{"name":"cpes","type":"\u0019\u001bcpe","title":"Common Platform Enumeration (CPE) identifiers for matching against vulnerability advisories","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Manifest and lock files that contributed this crate to the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the crate within the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Name of the crate","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl), a standardized identifier for the crate","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Resolved crate version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Rust/Cargo crate dependency","desc":"Single Rust crate in the software inventory, exposing its unique `id`, crate `name`, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the manifest or lock files that declared it.","min_provider_version":"13.10.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rust.packages":{"id":"rust.packages","name":"rust.packages","fields":{"directDependencies":{"name":"directDependencies","type":"\u0019\u001brust.package","title":"List of direct dependencies","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001brust.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for Cargo files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"root":{"name":"root","type":"\u001brust.package","title":"Root crate (may not exist)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001brust.package","title":"Rust/Cargo crate inventory","desc":"Rust crates discovered from Cargo sources: the `root` crate, the `directDependencies`, and the full transitive tree (iterated from the list itself). Parsed from Cargo manifests and lockfiles. Pass `path` to point at a specific project.","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"safari":{"id":"safari","name":"safari","fields":{"extension":{"name":"extension","type":"\u001bsafari.extension","title":"Safari browser extension","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"extensions":{"name":"extensions","type":"\u0019\u001bsafari.extension","title":"All installed Safari extensions","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Safari browser (macOS only)","desc":"Safari web browser on macOS. The `extensions` collection lists every installed Safari extension across all user accounts on the host, letting audits flag unknown or disabled extensions and verify their provenance.","min_provider_version":"11.4.86","provider":"go.mondoo.com/cnquery/v9/providers/os"},"safari.extension":{"id":"safari.extension","name":"safari.extension","fields":{"containerAppName":{"name":"containerAppName","type":"\u0007","is_mandatory":true,"title":"Containing application name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"containerAppPath":{"name":"containerAppPath","type":"\u0007","is_mandatory":true,"title":"Containing application path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Extension description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the extension is enabled in Safari preferences","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"extensionType":{"name":"extensionType","type":"\u0007","is_mandatory":true,"title":"Extension type (e.g., \"web-extension\", \"extension\", \"content-blocker\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"Extension bundle identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Extension name from Info.plist","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the extension bundle","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uid":{"name":"uid","type":"\u0005","is_mandatory":true,"title":"UID of the user who owns this extension","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Extension version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Safari browser extension","private":true,"min_provider_version":"11.4.86","defaults":"name version identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"secpol":{"id":"secpol","name":"secpol","fields":{"eventaudit":{"name":"eventaudit","type":"\u001a\u0007\u0007","title":"Event audit","provider":"go.mondoo.com/cnquery/v9/providers/os"},"privilegerights":{"name":"privilegerights","type":"\u001a\u0007\u0019\u0007","title":"Privilege rights","provider":"go.mondoo.com/cnquery/v9/providers/os"},"registryvalues":{"name":"registryvalues","type":"\u001a\u0007\u0007","title":"Registry values","provider":"go.mondoo.com/cnquery/v9/providers/os"},"systemaccess":{"name":"systemaccess","type":"\u001a\u0007\u0007","title":"System access","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows local security policy","desc":"Windows local security policy exported via secedit, broken into four maps. `systemaccess` covers password and account-lockout settings (for example MinimumPasswordLength, LockoutBadCount); `eventaudit` holds the legacy audit categories; `registryvalues` exposes security-relevant registry-backed policies; and `privilegerights` maps each user right (for example SeDenyNetworkLogonRight) to the accounts granted it. These are the primary source for CIS-style local policy benchmarks.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"selinux":{"id":"selinux","name":"selinux","fields":{"boolean":{"name":"boolean","type":"\u001bselinux.boolean","title":"SELinux boolean setting","desc":"One tunable SELinux boolean and its current runtime value (from `getsebool -a` or /sys/fs/selinux/booleans), e.g. httpd_can_network_connect.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"booleans":{"name":"booleans","type":"\u0019\u001bselinux.boolean","title":"Loaded SELinux booleans","provider":"go.mondoo.com/cnquery/v9/providers/os"},"configMode":{"name":"configMode","type":"\u0007","title":"Configured mode from /etc/selinux/config (persists across reboot)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installed":{"name":"installed","type":"\u0004","title":"Whether SELinux is installed on the system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mode":{"name":"mode","type":"\u0007","title":"Current enforcement mode: enforcing, permissive, or disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"module":{"name":"module","type":"\u001bselinux.module","title":"SELinux policy module","desc":"One installed SELinux policy module from `semodule -l`, with its status (enabled or disabled) and priority (higher priority overrides lower for the same module name).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"modules":{"name":"modules","type":"\u0019\u001bselinux.module","title":"Installed SELinux policy modules","provider":"go.mondoo.com/cnquery/v9/providers/os"},"policyType":{"name":"policyType","type":"\u0007","title":"Active policy type (e.g., targeted, mls, minimum)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"SELinux mandatory access control","desc":"SELinux enforcement mode, configured mode, active policy type, tunable booleans, and loaded policy modules. The runtime `mode` (from getenforce, /sys/fs/selinux/enforce, or config) may differ from `configMode`, which is what persists across reboot; compare the two to catch a system left permissive at runtime.","min_provider_version":"13.2.6","defaults":"mode","provider":"go.mondoo.com/cnquery/v9/providers/os"},"selinux.boolean":{"id":"selinux.boolean","name":"selinux.boolean","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Boolean name (e.g., httpd_can_network_connect)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"value":{"name":"value","type":"\u0004","is_mandatory":true,"title":"Current runtime value","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"SELinux boolean setting","desc":"One tunable SELinux boolean and its current runtime value (from `getsebool -a` or /sys/fs/selinux/booleans), e.g. httpd_can_network_connect.","private":true,"min_provider_version":"13.2.6","defaults":"name value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"selinux.module":{"id":"selinux.module","name":"selinux.module","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Module name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Module priority","provider":"go.mondoo.com/cnquery/v9/providers/os"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Module status (e.g., enabled, disabled)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"SELinux policy module","desc":"One installed SELinux policy module from `semodule -l`, with its status (enabled or disabled) and priority (higher priority overrides lower for the same module name).","private":true,"min_provider_version":"13.2.6","defaults":"name status","provider":"go.mondoo.com/cnquery/v9/providers/os"},"service":{"id":"service","name":"service","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Service description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the service is enabled (start at boot)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installed":{"name":"installed","type":"\u0004","is_mandatory":true,"title":"Whether the service is installed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"masked":{"name":"masked","type":"\u0004","is_mandatory":true,"title":"Whether the service is masked (symlinked to /dev/null so it cannot start)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the service","provider":"go.mondoo.com/cnquery/v9/providers/os"},"running":{"name":"running","type":"\u0004","is_mandatory":true,"title":"Whether the service is running","provider":"go.mondoo.com/cnquery/v9/providers/os"},"static":{"name":"static","type":"\u0004","is_mandatory":true,"title":"Whether the service is static (unit file has no [Install] section and cannot be enabled/disabled)","min_provider_version":"11.8.12","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Service type (e.g., simple, forking, oneshot, notify)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Service on the system","desc":"Single init/service-manager unit (systemd, SysV, launchd, and others), selected by name (e.g., `service(name: \"sshd\")`). Exposes install, enable, and run state plus the unit type and mask/static metadata, so you can assert that required services run and unwanted ones stay off.","min_provider_version":"9.0.0","defaults":"name running enabled type","provider":"go.mondoo.com/cnquery/v9/providers/os"},"services":{"id":"services","name":"services","fields":{"list":{"name":"list","type":"\u0019\u001bservice","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bservice","title":"All services configured on the system","desc":"Collection of every service across the asset's init/service manager. Filter it to find running-but-unwanted or disabled-but-required services, e.g. `services.where(running == true)`.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"shadow":{"id":"shadow","name":"shadow","fields":{"entry":{"name":"entry","type":"\u001bshadow.entry","title":"Shadowed password file entry","desc":"A single line from `/etc/shadow`: the username, hashed password field, date of last change, minimum and maximum password age in days, warning period, inactivity period, and account expiry date. Used to audit password aging policy compliance and to detect accounts with no expiry or with locked passwords (a `!` or `*` in the password field).","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"list":{"name":"list","type":"\u0019\u001bshadow.entry","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bshadow.entry","title":"Shadow password file (/etc/shadow)","desc":"Per-user password aging, expiration, and lock state parsed from `/etc/shadow`, one `shadow.entry` per account. Audit password policy compliance and find accounts with no expiry, weak aging settings, or locked/disabled passwords.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"shadow.entry":{"id":"shadow.entry","name":"shadow.entry","fields":{"expirydates":{"name":"expirydates","type":"\u0007","is_mandatory":true,"title":"Account expiration date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inactivedays":{"name":"inactivedays","type":"\u0005","is_mandatory":true,"title":"Days after password expiry before the account is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastchanged":{"name":"lastchanged","type":"\t","is_mandatory":true,"title":"Date of the last password change","provider":"go.mondoo.com/cnquery/v9/providers/os"},"maxdays":{"name":"maxdays","type":"\u0005","is_mandatory":true,"title":"Maximum password age in days before a change is required","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mindays":{"name":"mindays","type":"\u0005","is_mandatory":true,"title":"Minimum password age in days before it may be changed again","provider":"go.mondoo.com/cnquery/v9/providers/os"},"password":{"name":"password","type":"\u0007","is_mandatory":true,"title":"Hashed password field (`*` or `!` marks a locked or disabled login; empty means no password)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"reserved":{"name":"reserved","type":"\u0007","is_mandatory":true,"title":"Reserved field","provider":"go.mondoo.com/cnquery/v9/providers/os"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"Username from the /etc/shadow entry","provider":"go.mondoo.com/cnquery/v9/providers/os"},"warndays":{"name":"warndays","type":"\u0005","is_mandatory":true,"title":"Number of days before expiry the user is warned to change the password","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Shadowed password file entry","desc":"A single line from `/etc/shadow`: the username, hashed password field, date of last change, minimum and maximum password age in days, warning period, inactivity period, and account expiry date. Used to audit password aging policy compliance and to detect accounts with no expiry or with locked passwords (a `!` or `*` in the password field).","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"snmpd":{"id":"snmpd","name":"snmpd","fields":{"config":{"name":"config","type":"\u001bsnmpd.config","title":"Net-SNMP daemon (snmpd) configuration","desc":"snmpd.conf settings that govern SNMP access: community strings, VACM users, and listen addresses. The configuration is assembled from the main snmpd.conf together with any drop-in files under snmpd.conf.d and files pulled in by includeFile and includeDir directives. A missing configuration yields empty accessors, so audits such as rwCommunities == [] hold trivially on hosts that don't run snmpd.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"title":"Net-SNMP daemon (snmpd) namespace","desc":"Namespace hosting `snmpd.config`, the entry point for examining the effective SNMP daemon configuration.","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"snmpd.config":{"id":"snmpd.config","name":"snmpd.config","fields":{"agentAddresses":{"name":"agentAddresses","type":"\u0019\u0007","refs":["\"content\""],"title":"Addresses snmpd listens on, from agentAddress directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","refs":["\"files\""],"title":"Merged contents of all configuration files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","title":"Primary snmpd configuration file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bfile","refs":["\"file\""],"title":"All files making up the SNMP daemon configuration (main file, drop-ins, and includes)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"roCommunities":{"name":"roCommunities","type":"\u0019\u0007","refs":["\"content\""],"title":"Read-only community strings, from rocommunity and rocommunity6 directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"roUsers":{"name":"roUsers","type":"\u0019\u0007","refs":["\"content\""],"title":"Read-only VACM users, from rouser directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rwCommunities":{"name":"rwCommunities","type":"\u0019\u0007","refs":["\"content\""],"title":"Read-write community strings, from rwcommunity and rwcommunity6 directives","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rwUsers":{"name":"rwUsers","type":"\u0019\u0007","refs":["\"content\""],"title":"Read-write VACM users, from rwuser directives","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"Net-SNMP daemon (snmpd) configuration","desc":"snmpd.conf settings that govern SNMP access: community strings, VACM users, and listen addresses. The configuration is assembled from the main snmpd.conf together with any drop-in files under snmpd.conf.d and files pulled in by includeFile and includeDir directives. A missing configuration yields empty accessors, so audits such as rwCommunities == [] hold trivially on hosts that don't run snmpd.","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"snowflake":{"id":"snowflake","fields":{"cortex":{"name":"cortex","type":"\u001bsnowflake.cortex","title":"Snowflake Cortex Code instance","desc":"Snowflake Cortex Code, Snowflake's AI coding assistant, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .snowflake/cortex in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://www.snowflake.com/en/product/features/cortex-code/","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"}},"is_extension":true},"snowflake.cortex":{"id":"snowflake.cortex","name":"snowflake.cortex","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Cortex configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bsnowflake.cortex.skill","title":"Snowflake Cortex Code skill","desc":"A single SKILL.md definition discovered for the Snowflake Cortex Code agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bsnowflake.cortex.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Snowflake Cortex Code instance","desc":"Snowflake Cortex Code, Snowflake's AI coding assistant, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .snowflake/cortex in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://www.snowflake.com/en/product/features/cortex-code/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"snowflake.cortex.skill":{"id":"snowflake.cortex.skill","name":"snowflake.cortex.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Snowflake Cortex Code skill","desc":"A single SKILL.md definition discovered for the Snowflake Cortex Code agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"squid":{"id":"squid","name":"squid","fields":{"conf":{"name":"conf","type":"\u001bsquid.conf","title":"Squid caching proxy configuration","desc":"Parsed Squid configuration covering directives, access control lists, listen ports, cache peers, cache directories, refresh patterns, authentication parameters, and access logs from `squid.conf` together with every fragment pulled in by `include` directives. Files matched by glob patterns in include lines (e.g. `include /etc/squid/conf.d/*.conf`) are walked recursively and merged into a single logical configuration, so audits see the flattened directive set the daemon actually runs with.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"version":{"name":"version","type":"\u0007","title":"Squid version (e.g., \"5.7\")","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Squid caching proxy","desc":"Squid proxy server version reported by the daemon binary. Use `squid.conf` to inspect the full configuration including ACLs, access rules, listen ports, cache peers, refresh patterns, and any fragments pulled in by `include` directives (for example the contents of `/etc/squid/conf.d/*.conf`).","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"squid.conf":{"id":"squid.conf","name":"squid.conf","fields":{"accessLog":{"name":"accessLog","type":"\u001bsquid.conf.accessLog","title":"Squid access_log entry","desc":"Single `access_log` directive: where requests are written (file path, daemon module target, or \"none\"), which logformat is in use, and which ACLs gate the log line. Multiple `access_log` lines produce multiple entries in this list.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"accessLogs":{"name":"accessLogs","type":"\u0019\u001bsquid.conf.accessLog","refs":["\"file\""],"title":"access_log entries (each daemon target / format / acl pair)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"accessRule":{"name":"accessRule","type":"\u001bsquid.conf.accessRule","title":"Squid *_access rule","desc":"Single allow/deny rule from any of the access directives (`http_access`, `http_reply_access`, `icp_access`, `miss_access`, `cache`, `always_direct`, `never_direct`, etc.). Rules are evaluated top-down by Squid, so the `index` field reflects source order across the merged configuration.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"accessRules":{"name":"accessRules","type":"\u0019\u001bsquid.conf.accessRule","refs":["\"file\""],"title":"Every *_access rule in source order","desc":"Includes http_access, http_reply_access, adapted_http_access, icp_access, htcp_access, miss_access, cache, always_direct, never_direct, and the other access directives. Filter by kind to target one family: `.where(kind == \"http_access\")`.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"acl":{"name":"acl","type":"\u001bsquid.conf.acl","title":"Squid Access Control List entry","desc":"Single `acl` definition. ACLs are referenced by name from `http_access`, `icp_access`, and the other *_access rules, so the `values` field together with the rule list tells you which clients, URLs, or methods Squid will allow or deny.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"acls":{"name":"acls","type":"\u0019\u001bsquid.conf.acl","refs":["\"file\""],"title":"Defined ACLs, one entry per unique acl name (values across repeated `acl NAME` lines are merged)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"authParams":{"name":"authParams","type":"\u001a\u0007\u001a\u0007\u0007","refs":["\"file\""],"title":"auth_param entries grouped by scheme -\u003e param -\u003e value (e.g., authParams[\"basic\"][\"program\"])","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cacheDir":{"name":"cacheDir","type":"\u001bsquid.conf.cacheDir","title":"Squid cache directory","desc":"Single `cache_dir` entry, the on-disk cache storage backing the proxy. Captures the storage `type` (ufs, aufs, diskd, rock), the filesystem `path`, the cache size, the L1/L2 fan-out for hashed stores, and any trailing `key=value` options (e.g., `max-size=`).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"cacheDirs":{"name":"cacheDirs","type":"\u0019\u001bsquid.conf.cacheDir","refs":["\"file\""],"title":"cache_dir entries (on-disk cache storage)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cacheLog":{"name":"cacheLog","type":"\u0007","refs":["\"params\""],"title":"cache_log directive value (path to the cache.log file)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cacheMem":{"name":"cacheMem","type":"\u0007","refs":["\"params\""],"title":"cache_mem directive value (e.g., \"256 MB\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cachePeer":{"name":"cachePeer","type":"\u001bsquid.conf.cachePeer","title":"Squid cache peer","desc":"Single `cache_peer` entry, a parent or sibling cache Squid forwards to. The `host`, `type`, and `httpPort` together identify the peer; the `options` slice carries the remaining flags (`default`, `no-query`, `proxy-only`, `login=...`, `weight=...`, ...).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"cachePeers":{"name":"cachePeers","type":"\u0019\u001bsquid.conf.cachePeer","refs":["\"file\""],"title":"cache_peer entries (parents and siblings)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cacheStoreLog":{"name":"cacheStoreLog","type":"\u0007","refs":["\"params\""],"title":"cache_store_log directive value (path or \"none\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"certificates":{"name":"certificates","type":"\u0019\u001bcertificate","title":"X.509 certificates parsed from cert= / tls-cert= paths declared on http_port and https_port entries","provider":"go.mondoo.com/cnquery/v9/providers/os"},"coredumpDir":{"name":"coredumpDir","type":"\u0007","refs":["\"params\""],"title":"coredump_dir directive value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dnsV4First":{"name":"dnsV4First","type":"\u0007","refs":["\"params\""],"title":"dns_v4_first directive value (\"on\" or \"off\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","title":"Primary configuration file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bfile","refs":["\"file\""],"title":"All configuration files (main + included fragments)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"forwardedFor":{"name":"forwardedFor","type":"\u0007","refs":["\"params\""],"title":"forwarded_for directive value (on, off, transparent, delete, truncate)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpPorts":{"name":"httpPorts","type":"\u0019\u001bsquid.conf.listen","refs":["\"file\""],"title":"http_port listen entries","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpdSuppressVersionString":{"name":"httpdSuppressVersionString","type":"\u0007","refs":["\"params\""],"title":"httpd_suppress_version_string directive value (\"on\" or \"off\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpsPorts":{"name":"httpsPorts","type":"\u0019\u001bsquid.conf.listen","refs":["\"file\""],"title":"https_port listen entries","provider":"go.mondoo.com/cnquery/v9/providers/os"},"listen":{"name":"listen","type":"\u001bsquid.conf.listen","title":"Squid listen port (http_port or https_port)","desc":"Single `http_port` or `https_port` directive: the bind address, port number, parsed mode flags (transparent, intercept, accel, ssl-bump, tproxy), and any `key=value` options including the TLS material (`cert=`, `key=`, `tls-cert=`, `tls-key=`).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"maximumObjectSize":{"name":"maximumObjectSize","type":"\u0007","refs":["\"params\""],"title":"maximum_object_size directive value (e.g., \"4 MB\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"file\""],"title":"Flat key-value directives across the merged configuration","desc":"Directives that can repeat (acl, http_access, refresh_pattern, ...) have their values comma-joined in source order.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pidFilename":{"name":"pidFilename","type":"\u0007","refs":["\"params\""],"title":"pid_filename directive value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"refreshPattern":{"name":"refreshPattern","type":"\u001bsquid.conf.refreshPattern","title":"Squid refresh_pattern rule","desc":"Single `refresh_pattern` directive: the regex Squid uses to match URLs, the freshness window (`min` / `percent` / `max`), and any trailing flags. Audit hot spots include `ignore-private`, `ignore-no-store`, `override-expire`, and `override-lastmod`, which weaken cache safety guarantees.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"refreshPatterns":{"name":"refreshPatterns","type":"\u0019\u001bsquid.conf.refreshPattern","refs":["\"file\""],"title":"refresh_pattern entries (cache freshness rules) in source order","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uniqueHostname":{"name":"uniqueHostname","type":"\u0007","refs":["\"params\""],"title":"unique_hostname directive value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"via":{"name":"via","type":"\u0007","refs":["\"params\""],"title":"via directive value (\"on\" or \"off\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"visibleHostname":{"name":"visibleHostname","type":"\u0007","refs":["\"params\""],"title":"visible_hostname directive value","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"Squid caching proxy configuration","desc":"Parsed Squid configuration covering directives, access control lists, listen ports, cache peers, cache directories, refresh patterns, authentication parameters, and access logs from `squid.conf` together with every fragment pulled in by `include` directives. Files matched by glob patterns in include lines (e.g. `include /etc/squid/conf.d/*.conf`) are walked recursively and merged into a single logical configuration, so audits see the flattened directive set the daemon actually runs with.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"squid.conf.accessLog":{"id":"squid.conf.accessLog","name":"squid.conf.accessLog","fields":{"acls":{"name":"acls","type":"\u0019\u0007","is_mandatory":true,"title":"Trailing ACL names that gate this log line, in argument order (an entry starting with \"!\" is a negated ACL)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"format":{"name":"format","type":"\u0007","is_mandatory":true,"title":"logformat name selecting the output format (\"squid\" when unspecified, or the name from a `logformat NAME ...` line)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Original directive arguments, joined by spaces","provider":"go.mondoo.com/cnquery/v9/providers/os"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"Log target (\"/var/log/squid/access.log\", \"daemon:/var/log/...\", \"stdio:/var/log/...\", \"syslog:...\", or \"none\" to disable)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Squid access_log entry","desc":"Single `access_log` directive: where requests are written (file path, daemon module target, or \"none\"), which logformat is in use, and which ACLs gate the log line. Multiple `access_log` lines produce multiple entries in this list.","private":true,"min_provider_version":"13.16.10","defaults":"target format","provider":"go.mondoo.com/cnquery/v9/providers/os"},"squid.conf.accessRule":{"id":"squid.conf.accessRule","name":"squid.conf.accessRule","fields":{"acls":{"name":"acls","type":"\u0019\u0007","is_mandatory":true,"title":"ACL names referenced by this rule, in argument order. An entry starting with \"!\" is a negated ACL.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"\"allow\" or \"deny\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"index":{"name":"index","type":"\u0005","is_mandatory":true,"title":"0-based position of this rule within `kind`, in source order across all included files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Directive name (e.g., \"http_access\", \"icp_access\", \"miss_access\", \"cache\", \"always_direct\", \"never_direct\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Original directive arguments, joined by spaces","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Squid *_access rule","desc":"Single allow/deny rule from any of the access directives (`http_access`, `http_reply_access`, `icp_access`, `miss_access`, `cache`, `always_direct`, `never_direct`, etc.). Rules are evaluated top-down by Squid, so the `index` field reflects source order across the merged configuration.","private":true,"min_provider_version":"13.16.10","defaults":"kind action acls","provider":"go.mondoo.com/cnquery/v9/providers/os"},"squid.conf.acl":{"id":"squid.conf.acl","name":"squid.conf.acl","fields":{"flags":{"name":"flags","type":"\u0019\u0007","is_mandatory":true,"title":"Modifier flags present on any of the acl lines (e.g., \"-i\" for case-insensitive)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"ACL name (e.g., \"localnet\", \"Safe_ports\", \"CONNECT\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"ACL type (src, dst, port, srcdomain, url_regex, proto, method, proxy_auth, ...)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"values":{"name":"values","type":"\u0019\u0007","is_mandatory":true,"title":"All match values from every `acl NAME ...` line with this name, in source order","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Squid Access Control List entry","desc":"Single `acl` definition. ACLs are referenced by name from `http_access`, `icp_access`, and the other *_access rules, so the `values` field together with the rule list tells you which clients, URLs, or methods Squid will allow or deny.","private":true,"min_provider_version":"13.16.10","defaults":"name type","provider":"go.mondoo.com/cnquery/v9/providers/os"},"squid.conf.cacheDir":{"id":"squid.conf.cacheDir","name":"squid.conf.cacheDir","fields":{"l1":{"name":"l1","type":"\u0005","is_mandatory":true,"title":"L1 subdirectory count (0 for rock and other single-file stores)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"l2":{"name":"l2","type":"\u0005","is_mandatory":true,"title":"L2 subdirectory count (0 for rock and other single-file stores)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"Trailing options on the directive (e.g., max-size=4194304, min-size=0)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Filesystem path of the cache","provider":"go.mondoo.com/cnquery/v9/providers/os"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Original directive arguments, joined by spaces","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sizeMb":{"name":"sizeMb","type":"\u0005","is_mandatory":true,"title":"Cache size in megabytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Storage scheme (ufs, aufs, diskd, rock, ...)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Squid cache directory","desc":"Single `cache_dir` entry, the on-disk cache storage backing the proxy. Captures the storage `type` (ufs, aufs, diskd, rock), the filesystem `path`, the cache size, the L1/L2 fan-out for hashed stores, and any trailing `key=value` options (e.g., `max-size=`).","private":true,"min_provider_version":"13.16.10","defaults":"type path sizeMb","provider":"go.mondoo.com/cnquery/v9/providers/os"},"squid.conf.cachePeer":{"id":"squid.conf.cachePeer","name":"squid.conf.cachePeer","fields":{"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Peer hostname or IP","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpPort":{"name":"httpPort","type":"\u0005","is_mandatory":true,"title":"HTTP port on the peer","provider":"go.mondoo.com/cnquery/v9/providers/os"},"icpPort":{"name":"icpPort","type":"\u0005","is_mandatory":true,"title":"ICP/HTCP query port on the peer (0 when disabled)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"Trailing options on the directive (e.g., default, no-query, proxy-only, login=NAME)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Original directive arguments, joined by spaces","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Peer relationship (\"parent\", \"sibling\", or \"multicast\")","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Squid cache peer","desc":"Single `cache_peer` entry, a parent or sibling cache Squid forwards to. The `host`, `type`, and `httpPort` together identify the peer; the `options` slice carries the remaining flags (`default`, `no-query`, `proxy-only`, `login=...`, `weight=...`, ...).","private":true,"min_provider_version":"13.16.10","defaults":"host type httpPort","provider":"go.mondoo.com/cnquery/v9/providers/os"},"squid.conf.listen":{"id":"squid.conf.listen","name":"squid.conf.listen","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Bind address (\"\" when none was given, IPv4/IPv6 literal, or \"unix:/path\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cert":{"name":"cert","type":"\u0007","is_mandatory":true,"title":"Path to the server certificate when set (`cert=` or `tls-cert=`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"directive":{"name":"directive","type":"\u0007","is_mandatory":true,"title":"Directive name this entry came from (\"http_port\" or \"https_port\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"flags":{"name":"flags","type":"\u0019\u0007","is_mandatory":true,"title":"Mode flags present on the directive (e.g., transparent, intercept, accel, ssl-bump, tproxy, ssl)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Path to the server private key when set (`key=` or `tls-key=`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"All `key=value` options on the directive","provider":"go.mondoo.com/cnquery/v9/providers/os"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Numeric port (0 when the target is a unix socket)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Original directive arguments, joined by spaces","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tls":{"name":"tls","type":"\u0004","is_mandatory":true,"title":"Whether this entry serves TLS (https_port, or http_port with ssl-bump / tls-cert= / cert=)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Squid listen port (http_port or https_port)","desc":"Single `http_port` or `https_port` directive: the bind address, port number, parsed mode flags (transparent, intercept, accel, ssl-bump, tproxy), and any `key=value` options including the TLS material (`cert=`, `key=`, `tls-cert=`, `tls-key=`).","private":true,"min_provider_version":"13.16.10","defaults":"port address tls","provider":"go.mondoo.com/cnquery/v9/providers/os"},"squid.conf.refreshPattern":{"id":"squid.conf.refreshPattern","name":"squid.conf.refreshPattern","fields":{"caseInsensitive":{"name":"caseInsensitive","type":"\u0004","is_mandatory":true,"title":"Whether the rule was declared case-insensitive (-i)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"max":{"name":"max","type":"\u0005","is_mandatory":true,"title":"Maximum freshness in minutes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"min":{"name":"min","type":"\u0005","is_mandatory":true,"title":"Minimum freshness in minutes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"Trailing flag options","desc":"Common entries: override-expire, override-lastmod, ignore-no-store, ignore-private, ignore-reload, reload-into-ims, refresh-ims, store-stale, max-stale=N.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pattern":{"name":"pattern","type":"\u0007","is_mandatory":true,"title":"Regex pattern this rule applies to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"percent":{"name":"percent","type":"\u0005","is_mandatory":true,"title":"Percent of last-modified age used to compute freshness","provider":"go.mondoo.com/cnquery/v9/providers/os"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Original directive arguments, joined by spaces","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Squid refresh_pattern rule","desc":"Single `refresh_pattern` directive: the regex Squid uses to match URLs, the freshness window (`min` / `percent` / `max`), and any trailing flags. Audit hot spots include `ignore-private`, `ignore-no-store`, `override-expire`, and `override-lastmod`, which weaken cache safety guarantees.","private":true,"min_provider_version":"13.16.10","defaults":"pattern min max","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sshd":{"id":"sshd","name":"sshd","fields":{"config":{"name":"config","type":"\u001bsshd.config","title":"OpenSSH server (sshd) configuration","desc":"OpenSSH server settings parsed from sshd_config (and any Include files), plus the effective values reported by `sshd -T`. Surfaces `ciphers`, `macs`, `kexs`, and `hostkeyalgorithms` for cryptographic hardening checks, `permitRootLogin` for root-access policy, and `blocks` for the conditional Match blocks. Compare the configured values (`ciphers`) against the effective ones (`effectiveCiphers`) to catch overrides applied at runtime.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"title":"OpenSSH server (sshd) namespace","desc":"Namespace hosting `sshd.config`, the entry point for auditing the OpenSSH server's effective settings and Match blocks.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sshd.config":{"id":"sshd.config","name":"sshd.config","fields":{"blocks":{"name":"blocks","type":"\u0019\u001bsshd.config.matchBlock","refs":["\"file\""],"title":"Blocks with match conditions in this SSH server config","min_provider_version":"10.0.5","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ciphers":{"name":"ciphers","type":"\u0019\u0007","refs":["\"params\""],"title":"Ciphers configured for this SSH server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"effectiveCiphers":{"name":"effectiveCiphers","type":"\u0019\u0007","title":"Effective ciphers reported by sshd -T","min_provider_version":"13.16.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"effectiveKexs":{"name":"effectiveKexs","type":"\u0019\u0007","title":"Effective key exchange algorithms reported by sshd -T","min_provider_version":"13.16.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"effectiveMacs":{"name":"effectiveMacs","type":"\u0019\u0007","title":"Effective MACs reported by sshd -T","min_provider_version":"13.16.9","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","title":"File of this SSH server configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bfile","refs":["\"file\""],"title":"A list of lexically sorted files making up the SSH server configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hostkeyalgorithms":{"name":"hostkeyalgorithms","type":"\u0019\u0007","refs":["\"params\""],"title":"Host key algorithms configured for this SSH server","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hostkeys":{"name":"hostkeys","type":"\u0019\u0007","refs":["\"params\""],"title":"Host keys configured for this SSH server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"kexs":{"name":"kexs","type":"\u0019\u0007","refs":["\"params\""],"title":"Key exchange algorithms configured for this SSH server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macs":{"name":"macs","type":"\u0019\u0007","refs":["\"params\""],"title":"MACs configured for this SSH server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"matchBlock":{"name":"matchBlock","type":"\u001bsshd.config.matchBlock","title":"A block of SSH server configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"file\""],"title":"Configuration values of this SSH server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"permitRootLogin":{"name":"permitRootLogin","type":"\u0019\u0007","refs":["\"params\""],"title":"PermitRootLogin setting in SSH server","min_provider_version":"10.0.5","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"OpenSSH server (sshd) configuration","desc":"OpenSSH server settings parsed from sshd_config (and any Include files), plus the effective values reported by `sshd -T`. Surfaces `ciphers`, `macs`, `kexs`, and `hostkeyalgorithms` for cryptographic hardening checks, `permitRootLogin` for root-access policy, and `blocks` for the conditional Match blocks. Compare the configured values (`ciphers`) against the effective ones (`effectiveCiphers`) to catch overrides applied at runtime.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sshd.config.matchBlock":{"id":"sshd.config.matchBlock","name":"sshd.config.matchBlock","fields":{"ciphers":{"name":"ciphers","type":"\u0019\u0007","refs":["\"params\""],"title":"Ciphers configured for this SSH server","min_provider_version":"11.4.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"context":{"name":"context","type":"\u001bfile.context","title":"Contextual info, where this resource is located and defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"criteria":{"name":"criteria","type":"\u0007","is_mandatory":true,"title":"The Match criteria that gate this block (e.g., \"User root\", \"Address 10.0.0.0/8\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hostkeyalgorithms":{"name":"hostkeyalgorithms","type":"\u0019\u0007","refs":["\"params\""],"title":"Host key algorithms configured for this SSH server","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hostkeys":{"name":"hostkeys","type":"\u0019\u0007","refs":["\"params\""],"title":"Host keys configured for this SSH server","min_provider_version":"11.4.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"kexs":{"name":"kexs","type":"\u0019\u0007","refs":["\"params\""],"title":"Key exchange algorithms configured for this SSH server","min_provider_version":"11.4.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"macs":{"name":"macs","type":"\u0019\u0007","refs":["\"params\""],"title":"MACs configured for this SSH server","min_provider_version":"11.4.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Configuration values in this block","provider":"go.mondoo.com/cnquery/v9/providers/os"},"permitRootLogin":{"name":"permitRootLogin","type":"\u0019\u0007","refs":["\"params\""],"title":"PermitRootLogin setting in SSH server","min_provider_version":"11.4.10","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"A block of SSH server configuration","private":true,"min_provider_version":"10.0.5","defaults":"criteria","context":"file.context","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sudo":{"id":"sudo","name":"sudo","fields":{"approvalPlugins":{"name":"approvalPlugins","type":"\u0019\u001bsudo.plugin","refs":["\"plugins\""],"title":"Approval plugins (sudo 1.9.1+)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditPlugins":{"name":"auditPlugins","type":"\u0019\u001bsudo.plugin","refs":["\"plugins\""],"title":"Audit plugins (sudo 1.9.3+)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installed":{"name":"installed","type":"\u0004","title":"Whether sudo is installed and executable","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ioPlugins":{"name":"ioPlugins","type":"\u0019\u001bsudo.plugin","refs":["\"plugins\""],"title":"I/O plugins (e.g., sudoers_io for log_input / log_output)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","title":"Path to the sudo binary","desc":"Filesystem-resolved location of the `sudo` binary on the asset (e.g., `/usr/bin/sudo`). Empty when sudo is not installed; check `installed` rather than testing this field for emptiness.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"plugin":{"name":"plugin","type":"\u001bsudo.plugin","title":"A sudo plugin reported by `sudo -V`","desc":"One loaded sudo plugin, identified by name and type (policy, I/O, audit, or approval) with its version and, when reported, the path to the .so file backing it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"plugins":{"name":"plugins","type":"\u0019\u001bsudo.plugin","title":"All sudo plugins reported by `sudo -V`","provider":"go.mondoo.com/cnquery/v9/providers/os"},"policyPlugin":{"name":"policyPlugin","type":"\u001bsudo.plugin","refs":["\"plugins\""],"title":"Policy plugin (typically sudoers_policy). Null when none is loaded.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pythonSupport":{"name":"pythonSupport","type":"\u0004","title":"Whether the build supports Python-based plugins","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sudoers":{"name":"sudoers","type":"\u001bsudoers","title":"Associated sudoers configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"validate":{"name":"validate","type":"\u001bsudo.validation","title":"Result of `visudo -c`. Null when sudoers files cannot be read (e.g., running unprivileged against a mode-0440 /etc/sudoers).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"validation":{"name":"validation","type":"\u001bsudo.validation","title":"Result of validating sudoers configuration with `visudo -c`","desc":"Syntax-check outcome for the sudoers files: `valid` is true when `visudo -c` exits cleanly, and `errors` lists every parse error otherwise.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"version":{"name":"version","type":"\u0007","title":"Version string reported by `sudo -V` (e.g., \"1.9.5p3\")","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"Sudo binary and runtime metadata","desc":"Installed `sudo` binary: where it lives on disk, the version it reports under `sudo -V`, which plugins are loaded (policy, I/O, audit, approval), whether the build supports Python-based plugins, and the result of `visudo -c` against the sudoers configuration. For sudoers configuration parsing, use the `sudoers` resource directly, or access it via this resource's `sudoers` field.","min_provider_version":"13.19.1","defaults":"version path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sudo.plugin":{"id":"sudo.plugin","name":"sudo.plugin","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Plugin name (e.g., \"sudoers_policy\", \"sudoers_io\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Full path to the plugin .so file when reported","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Plugin type: \"policy\", \"io\", \"audit\", or \"approval\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Plugin version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"A sudo plugin reported by `sudo -V`","desc":"One loaded sudo plugin, identified by name and type (policy, I/O, audit, or approval) with its version and, when reported, the path to the .so file backing it.","private":true,"min_provider_version":"13.19.1","defaults":"name type version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sudo.validation":{"id":"sudo.validation","name":"sudo.validation","fields":{"error":{"name":"error","type":"\u001bsudo.validation.error","title":"A single sudoers parse error reported by `visudo -c`","desc":"One syntax error found by `visudo -c`, locating the problem by file and line and giving the reported message.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"errors":{"name":"errors","type":"\u0019\u001bsudo.validation.error","is_mandatory":true,"title":"Parse errors. Empty when valid is true.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"valid":{"name":"valid","type":"\u0004","is_mandatory":true,"title":"True if `visudo -c` exits 0 with no errors","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Result of validating sudoers configuration with `visudo -c`","desc":"Syntax-check outcome for the sudoers files: `valid` is true when `visudo -c` exits cleanly, and `errors` lists every parse error otherwise.","private":true,"min_provider_version":"13.19.1","defaults":"valid","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sudo.validation.error":{"id":"sudo.validation.error","name":"sudo.validation.error","fields":{"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"File where the error was found","provider":"go.mondoo.com/cnquery/v9/providers/os"},"line":{"name":"line","type":"\u0005","is_mandatory":true,"title":"Line number of the error","provider":"go.mondoo.com/cnquery/v9/providers/os"},"message":{"name":"message","type":"\u0007","is_mandatory":true,"title":"Error message text","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"A single sudoers parse error reported by `visudo -c`","desc":"One syntax error found by `visudo -c`, locating the problem by file and line and giving the reported message.","private":true,"min_provider_version":"13.19.1","defaults":"file line","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sudoers":{"id":"sudoers","name":"sudoers","fields":{"alias":{"name":"alias","type":"\u001bsudoers.alias","title":"Sudoers alias definition","desc":"One alias declaration (User_Alias, Host_Alias, Cmnd_Alias, or Runas_Alias) and the members assigned to it, used to expand aliases referenced in user specifications.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"aliases":{"name":"aliases","type":"\u0019\u001bsudoers.alias","refs":["\"files\""],"title":"Alias definitions (User_Alias, Host_Alias, Cmnd_Alias, Runas_Alias)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","refs":["\"files\""],"title":"Raw contents of all sudoers files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"default":{"name":"default","type":"\u001bsudoers.default","title":"Sudoers default setting","desc":"One `Defaults` directive from the sudoers configuration, giving the parameter, its value and operation, the scope it applies at, and whether it is negated. Covers hardening flags such as env_reset and secure_path.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"defaults":{"name":"defaults","type":"\u0019\u001bsudoers.default","refs":["\"files\""],"title":"Default settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bfile","title":"List of files that make up the sudoers configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"userSpec":{"name":"userSpec","type":"\u001bsudoers.userSpec","title":"Sudoers user specification (permission entry)","desc":"Single sudoers permission rule: which users, on which hosts, may run which commands, as which run-as users/groups, under which tags (e.g. NOPASSWD). The building block for auditing privilege grants.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"userSpecs":{"name":"userSpecs","type":"\u0019\u001bsudoers.userSpec","refs":["\"files\""],"title":"User permission specifications","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"sudo authorization configuration","desc":"User specifications, defaults, and aliases parsed across the sudoers files (/etc/sudoers plus /etc/sudoers.d). Use userSpecs to audit who may run which commands as which users, and defaults to check hardening settings such as env_reset, secure_path, requiretty, and NOPASSWD grants. Point at an alternate root file with the `path` argument.","min_provider_version":"11.7.0","defaults":"files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sudoers.alias":{"id":"sudoers.alias","name":"sudoers.alias","fields":{"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"File where this entry is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"members":{"name":"members","type":"\u0019\u0007","is_mandatory":true,"title":"Values assigned to this alias","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Alias name (e.g., \"ADMINS\", \"WEBSERVERS\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type: user, host, cmnd, or runas","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Sudoers alias definition","desc":"One alias declaration (User_Alias, Host_Alias, Cmnd_Alias, or Runas_Alias) and the members assigned to it, used to expand aliases referenced in user specifications.","private":true,"min_provider_version":"11.7.0","defaults":"type name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sudoers.default":{"id":"sudoers.default","name":"sudoers.default","fields":{"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"File where this entry is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"negated":{"name":"negated","type":"\u0004","is_mandatory":true,"title":"Whether parameter is negated (starts with !)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"operation":{"name":"operation","type":"\u0007","is_mandatory":true,"title":"Operation: \"=\", \"+=\", or \"-=\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"parameter":{"name":"parameter","type":"\u0007","is_mandatory":true,"title":"Parameter name (e.g., \"env_reset\", \"secure_path\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Raw Defaults line","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope: global, user, host, command, or runas","provider":"go.mondoo.com/cnquery/v9/providers/os"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"Target (user/host/command/runas this applies to, if not global)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Value (if parameter takes a value)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Sudoers default setting","desc":"One `Defaults` directive from the sudoers configuration, giving the parameter, its value and operation, the scope it applies at, and whether it is negated. Covers hardening flags such as env_reset and secure_path.","private":true,"min_provider_version":"11.7.0","defaults":"parameter","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sudoers.userSpec":{"id":"sudoers.userSpec","name":"sudoers.userSpec","fields":{"commands":{"name":"commands","type":"\u0019\u0007","is_mandatory":true,"title":"Commands or command aliases","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"File where this entry is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hosts":{"name":"hosts","type":"\u0019\u0007","is_mandatory":true,"title":"Hosts or host aliases this rule applies to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runasGroups":{"name":"runasGroups","type":"\u0019\u0007","is_mandatory":true,"title":"RunAs groups (groups the command can be run as)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runasUsers":{"name":"runasUsers","type":"\u0019\u0007","is_mandatory":true,"title":"RunAs users (users the command can be run as)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags applied to the command (NOPASSWD, SETENV, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"users":{"name":"users","type":"\u0019\u0007","is_mandatory":true,"title":"Users or user aliases this rule applies to","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Sudoers user specification (permission entry)","desc":"Single sudoers permission rule: which users, on which hosts, may run which commands, as which run-as users/groups, under which tags (e.g. NOPASSWD). The building block for auditing privilege grants.","private":true,"min_provider_version":"11.7.0","defaults":"users hosts commands","provider":"go.mondoo.com/cnquery/v9/providers/os"},"swift":{"id":"swift","fields":{"package":{"name":"package","type":"\u001bswift.package","title":"Swift package dependency","desc":"Single Swift package in the software inventory, exposing its unique `id`, `name`, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the package files that declared it.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bswift.packages","title":"Swift package inventory (SPM and CocoaPods)","desc":"Swift packages referenced by a project through Swift Package Manager or CocoaPods, each with its resolved version. Set `path` to point at the directory holding the Swift package files.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"swift.package":{"id":"swift.package","name":"swift.package","fields":{"cpes":{"name":"cpes","type":"\u0019\u001bcpe","title":"Common Platform Enumeration (CPE) identifiers for matching against vulnerability advisories","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Package files that contributed this package to the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the package within the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Name of the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl), a standardized identifier for the package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Resolved package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Swift package dependency","desc":"Single Swift package in the software inventory, exposing its unique `id`, `name`, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the package files that declared it.","min_provider_version":"13.10.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"swift.packages":{"id":"swift.packages","name":"swift.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bswift.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for Swift package files","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bswift.package","title":"Swift package inventory (SPM and CocoaPods)","desc":"Swift packages referenced by a project through Swift Package Manager or CocoaPods, each with its resolved version. Set `path` to point at the directory holding the Swift package files.","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sysrc":{"id":"sysrc","name":"sysrc","fields":{"content":{"name":"content","type":"\u0007","refs":["\"files\""],"title":"Raw contents of all rc.conf files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entries":{"name":"entries","type":"\u0019\u001bsysrc.entry","refs":["\"files\""],"title":"Parsed key-value entries from all rc.conf files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entry":{"name":"entry","type":"\u001bsysrc.entry","title":"Single rc.conf variable entry","desc":"One variable assignment from an rc.conf file: its `name`, `value`, and the `file` it was defined in. The source file matters because a setting in rc.conf.local overrides the same name in rc.conf.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"files":{"name":"files","type":"\u0019\u001bfile","title":"List of rc.conf files that make up the configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"title":"FreeBSD rc.conf system configuration","desc":"FreeBSD service and system configuration merged from rc.conf and rc.conf.local. The `entries` accessor exposes each variable assignment as a structured name/value pair (with the file it came from), so audits can assert on individual settings such as sshd_enable or a firewall being turned on. `content` returns the concatenated raw text. Point at a specific file with `sysrc(path: \"...\")`.","min_provider_version":"13.2.6","defaults":"files","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sysrc.entry":{"id":"sysrc.entry","name":"sysrc.entry","fields":{"file":{"name":"file","type":"\u0007","is_mandatory":true,"title":"File where this entry is defined","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Variable name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Variable value","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Single rc.conf variable entry","desc":"One variable assignment from an rc.conf file: its `name`, `value`, and the `file` it was defined in. The source file matters because a setting in rc.conf.local overrides the same name in rc.conf.","private":true,"min_provider_version":"13.2.6","defaults":"name value","provider":"go.mondoo.com/cnquery/v9/providers/os"},"systemd":{"id":"systemd","fields":{"resolved":{"name":"resolved","type":"\u001bsystemd.resolved","title":"systemd-resolved DNS resolver state","desc":"Global DNS resolution configuration provided by systemd-resolved: whether the daemon is `active`, the effective DNS servers (`dns`) and `fallbackDns`, search `domains`, DNSSEC and DNS-over-TLS modes, LLMNR and multicast-DNS settings, the resolv.conf mode, and whether caching is enabled. Backed by `resolvectl status` for the Global scope. Useful for asserting that DNSSEC or DNS-over-TLS is enforced.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"socket":{"name":"socket","type":"\u001bsystemd.socket","title":"systemd socket unit","desc":"Single socket-activated unit, selected by name (e.g., `systemd.socket(name: \"sshd\")`). Exposes the listen addresses/ports, the service it activates, and enable/mask/run state, so you can audit which sockets expose network services.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"sockets":{"name":"sockets","type":"\u001bsystemd.sockets","title":"All systemd socket units on the system","desc":"Collection of every socket-activated unit, for listen-address and activation-target audits.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"target":{"name":"target","type":"\u001bsystemd.target","title":"systemd target unit","desc":"Single systemd target: its load state, active state, the unit file's enabled/disabled state, fragment path on disk, and the dependency lists (`wants`, `requires`, `after`, `before`) that determine which other units the target pulls in or orders around. Iterated from `systemd.targets`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"targets":{"name":"targets","type":"\u001bsystemd.targets","title":"All systemd target units on the system","desc":"Collection of every target unit, for auditing boot ordering, the default target, and dependency wiring.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"timer":{"name":"timer","type":"\u001bsystemd.timer","title":"systemd timer unit","desc":"Single systemd timer, selected by name (e.g., `systemd.timer(name: \"logrotate\")`). Exposes the schedule, the unit it activates, enable/mask/static state, and whether it is currently running, so you can audit scheduled maintenance and update jobs.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"timers":{"name":"timers","type":"\u001bsystemd.timers","title":"All systemd timer units on the system","desc":"Collection of every timer, for filtering by schedule, activation target, or status.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"timesyncd":{"name":"timesyncd","type":"\u001bsystemd.timesyncd","title":"systemd-timesyncd NTP client state","desc":"SNTP client state provided by systemd-timesyncd: whether the daemon is `active`, whether the system clock is currently `synchronized`, the configured `servers` and `fallbackServers`, the currently selected NTP `serverName` and `serverAddress`, the current poll interval, and the leap-second status. Backed by `timedatectl show` and `timedatectl show-timesync`. Useful for asserting that time is synchronized to an approved source.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"systemd.resolved":{"id":"systemd.resolved","name":"systemd.resolved","fields":{"active":{"name":"active","type":"\u0004","title":"Whether the systemd-resolved daemon is currently active","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cache":{"name":"cache","type":"\u0004","title":"Whether the resolver cache is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"currentDnsServer":{"name":"currentDnsServer","type":"\u0007","title":"DNS server currently in use for the Global scope","desc":"resolvectl picks one server from the configured `dns` list at a time; this is that selection. Empty when no global DNS server is active or the line is not emitted (e.g., when only per-link DNS is configured).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dns":{"name":"dns","type":"\u0019\u0007","title":"Effective DNS server addresses for the Global scope","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dnsOverTls":{"name":"dnsOverTls","type":"\u0007","title":"DNS-over-TLS mode (e.g., `yes`, `no`, `opportunistic`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dnssec":{"name":"dnssec","type":"\u0007","title":"DNSSEC mode","desc":"One of `yes`, `no`, or `allow-downgrade`. May appear as `no/unsupported` when the upstream resolver does not support DNSSEC.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"domains":{"name":"domains","type":"\u0019\u0007","title":"DNS search domains","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fallbackDns":{"name":"fallbackDns","type":"\u0019\u0007","title":"Fallback DNS servers used when no Link or Global DNS is configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"llmnr":{"name":"llmnr","type":"\u0007","title":"LLMNR mode (e.g., `yes`, `no`, `resolve`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"multicastDns":{"name":"multicastDns","type":"\u0007","title":"Multicast DNS mode (e.g., `yes`, `no`, `resolve`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"resolvConfMode":{"name":"resolvConfMode","type":"\u0007","title":"/etc/resolv.conf management mode (e.g., `stub`, `static`, `uplink`, `foreign`)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"systemd-resolved DNS resolver state","desc":"Global DNS resolution configuration provided by systemd-resolved: whether the daemon is `active`, the effective DNS servers (`dns`) and `fallbackDns`, search `domains`, DNSSEC and DNS-over-TLS modes, LLMNR and multicast-DNS settings, the resolv.conf mode, and whether caching is enabled. Backed by `resolvectl status` for the Global scope. Useful for asserting that DNSSEC or DNS-over-TLS is enforced.","min_provider_version":"13.16.10","defaults":"active dns","provider":"go.mondoo.com/cnquery/v9/providers/os"},"systemd.socket":{"id":"systemd.socket","name":"systemd.socket","fields":{"accept":{"name":"accept","type":"\u0004","title":"Whether the socket accepts connections (inetd-style, one service instance per connection)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"activates":{"name":"activates","type":"\u0007","title":"The unit that this socket activates (e.g., \"dbus.service\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Socket unit description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the socket is enabled (starts at boot)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installed":{"name":"installed","type":"\u0004","is_mandatory":true,"title":"Whether the socket unit file is installed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"listenAddresses":{"name":"listenAddresses","type":"\u0019\u0007","title":"Addresses, paths, or ports this socket listens on","provider":"go.mondoo.com/cnquery/v9/providers/os"},"masked":{"name":"masked","type":"\u0004","is_mandatory":true,"title":"Whether the socket is masked (symlinked to /dev/null so it cannot start)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the socket unit (without .socket suffix)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"running":{"name":"running","type":"\u0004","is_mandatory":true,"title":"Whether the socket is currently active","provider":"go.mondoo.com/cnquery/v9/providers/os"},"static":{"name":"static","type":"\u0004","is_mandatory":true,"title":"Whether the socket is static (unit file has no [Install] section)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"systemd socket unit","desc":"Single socket-activated unit, selected by name (e.g., `systemd.socket(name: \"sshd\")`). Exposes the listen addresses/ports, the service it activates, and enable/mask/run state, so you can audit which sockets expose network services.","min_provider_version":"13.7.1","defaults":"name enabled running","provider":"go.mondoo.com/cnquery/v9/providers/os"},"systemd.sockets":{"id":"systemd.sockets","name":"systemd.sockets","fields":{"list":{"name":"list","type":"\u0019\u001bsystemd.socket","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bsystemd.socket","title":"All systemd socket units on the system","desc":"Collection of every socket-activated unit, for listen-address and activation-target audits.","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"systemd.target":{"id":"systemd.target","name":"systemd.target","fields":{"activeState":{"name":"activeState","type":"\u0007","is_mandatory":true,"title":"Active state (e.g., active, inactive, failed, activating, deactivating)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"after":{"name":"after","type":"\u0019\u0007","is_mandatory":true,"title":"Units listed in After= (this target starts after them)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"before":{"name":"before","type":"\u0019\u0007","is_mandatory":true,"title":"Units listed in Before= (this target starts before them)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Target unit description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fragmentPath":{"name":"fragmentPath","type":"\u0007","is_mandatory":true,"title":"Path to the unit file on disk","provider":"go.mondoo.com/cnquery/v9/providers/os"},"loadState":{"name":"loadState","type":"\u0007","is_mandatory":true,"title":"Load state (e.g., loaded, not-found, masked, error)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the target unit (without .target suffix)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"requires":{"name":"requires","type":"\u0019\u0007","is_mandatory":true,"title":"Units listed in Requires= (hard dependencies)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"subState":{"name":"subState","type":"\u0007","is_mandatory":true,"title":"Sub state for the target (e.g., active, dead)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"unitFileState":{"name":"unitFileState","type":"\u0007","is_mandatory":true,"title":"Unit file state (e.g., enabled, disabled, static, masked, alias)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"wants":{"name":"wants","type":"\u0019\u0007","is_mandatory":true,"title":"Units listed in Wants= (best-effort dependencies)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"systemd target unit","desc":"Single systemd target: its load state, active state, the unit file's enabled/disabled state, fragment path on disk, and the dependency lists (`wants`, `requires`, `after`, `before`) that determine which other units the target pulls in or orders around. Iterated from `systemd.targets`.","private":true,"min_provider_version":"13.16.10","defaults":"name loadState activeState","provider":"go.mondoo.com/cnquery/v9/providers/os"},"systemd.targets":{"id":"systemd.targets","name":"systemd.targets","fields":{"list":{"name":"list","type":"\u0019\u001bsystemd.target","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bsystemd.target","title":"All systemd target units on the system","desc":"Collection of every target unit, for auditing boot ordering, the default target, and dependency wiring.","min_provider_version":"13.16.10","provider":"go.mondoo.com/cnquery/v9/providers/os"},"systemd.timer":{"id":"systemd.timer","name":"systemd.timer","fields":{"activates":{"name":"activates","type":"\u0007","title":"The unit that this timer activates (e.g., \"apt-daily.service\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Timer unit description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the timer is enabled (starts at boot)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installed":{"name":"installed","type":"\u0004","is_mandatory":true,"title":"Whether the timer unit file is installed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"masked":{"name":"masked","type":"\u0004","is_mandatory":true,"title":"Whether the timer is masked (symlinked to /dev/null so it cannot start)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the timer unit (without .timer suffix)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"onCalendar":{"name":"onCalendar","type":"\u0007","title":"Calendar expression for the timer schedule (empty for monotonic timers)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"persistent":{"name":"persistent","type":"\u0004","title":"Whether missed runs are triggered on next start","provider":"go.mondoo.com/cnquery/v9/providers/os"},"running":{"name":"running","type":"\u0004","is_mandatory":true,"title":"Whether the timer is currently active","provider":"go.mondoo.com/cnquery/v9/providers/os"},"static":{"name":"static","type":"\u0004","is_mandatory":true,"title":"Whether the timer is static (unit file has no [Install] section)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"systemd timer unit","desc":"Single systemd timer, selected by name (e.g., `systemd.timer(name: \"logrotate\")`). Exposes the schedule, the unit it activates, enable/mask/static state, and whether it is currently running, so you can audit scheduled maintenance and update jobs.","min_provider_version":"13.7.1","defaults":"name enabled running","provider":"go.mondoo.com/cnquery/v9/providers/os"},"systemd.timers":{"id":"systemd.timers","name":"systemd.timers","fields":{"list":{"name":"list","type":"\u0019\u001bsystemd.timer","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001bsystemd.timer","title":"All systemd timer units on the system","desc":"Collection of every timer, for filtering by schedule, activation target, or status.","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"systemd.timesyncd":{"id":"systemd.timesyncd","name":"systemd.timesyncd","fields":{"active":{"name":"active","type":"\u0004","title":"Whether the systemd-timesyncd daemon is currently active","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fallbackServers":{"name":"fallbackServers","type":"\u0019\u0007","title":"Fallback NTP servers used when none of `servers` are reachable","provider":"go.mondoo.com/cnquery/v9/providers/os"},"leapStatus":{"name":"leapStatus","type":"\u0007","title":"Leap second status (e.g., `normal`, `insert-second`, `delete-second`, `unknown`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pollIntervalUSec":{"name":"pollIntervalUSec","type":"\u0005","title":"Current poll interval in microseconds","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverAddress":{"name":"serverAddress","type":"\u0007","title":"IP address of the currently selected NTP server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverName":{"name":"serverName","type":"\u0007","title":"Hostname of the currently selected NTP server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"servers":{"name":"servers","type":"\u0019\u0007","title":"NTP servers from configuration (NTP= and DHCP)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"synchronized":{"name":"synchronized","type":"\u0004","title":"Whether the system clock is synchronized to a time source","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"systemd-timesyncd NTP client state","desc":"SNTP client state provided by systemd-timesyncd: whether the daemon is `active`, whether the system clock is currently `synchronized`, the configured `servers` and `fallbackServers`, the currently selected NTP `serverName` and `serverAddress`, the current poll interval, and the leap-second status. Backed by `timedatectl show` and `timedatectl show-timesync`. Useful for asserting that time is synchronized to an approved source.","min_provider_version":"13.16.10","defaults":"active synchronized serverName","provider":"go.mondoo.com/cnquery/v9/providers/os"},"terraform":{"id":"terraform","fields":{"package":{"name":"package","type":"\u001bterraform.package","title":"Terraform provider dependency","desc":"Single Terraform provider pinned in `.terraform.lock.hcl`, exposing its unique `id`, `name` in `namespace/type` form, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the lock files that reference it.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bterraform.packages","title":"Terraform provider inventory (SBOM cataloger)","desc":"Terraform provider versions pinned in `.terraform.lock.hcl`, useful for auditing which provider versions an infrastructure workspace depends on. Note: the terraform.* namespace is also used by the dedicated Terraform provider for IaC resource scanning. These SBOM resources focus on provider version inventory from .terraform.lock.hcl, not Terraform configuration analysis.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"terraform.package":{"id":"terraform.package","name":"terraform.package","fields":{"cpes":{"name":"cpes","type":"\u0019\u001bcpe","title":"Common Platform Enumeration (CPE) identifiers for matching against vulnerability advisories","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Lock files that reference this provider","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the provider within the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","title":"Name of the provider in namespace/type form","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL (purl), a standardized identifier for the provider","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"Pinned provider version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Terraform provider dependency","desc":"Single Terraform provider pinned in `.terraform.lock.hcl`, exposing its unique `id`, `name` in `namespace/type` form, `version`, `purl` identifier, CPE identifiers for vulnerability matching, and the lock files that reference it.","min_provider_version":"13.10.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"terraform.packages":{"id":"terraform.packages","name":"terraform.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bterraform.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to search for .terraform.lock.hcl","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bterraform.package","title":"Terraform provider inventory (SBOM cataloger)","desc":"Terraform provider versions pinned in `.terraform.lock.hcl`, useful for auditing which provider versions an infrastructure workspace depends on. Note: the terraform.* namespace is also used by the dedicated Terraform provider for IaC resource scanning. These SBOM resources focus on provider version inventory from .terraform.lock.hcl, not Terraform configuration analysis.","min_provider_version":"13.10.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"trae":{"id":"trae","name":"trae","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Trae configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001btrae.skill","title":"Trae skill","desc":"A single SKILL.md definition discovered for the Trae agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001btrae.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Trae AI assistant (ByteDance) instance","desc":"Trae, ByteDance's AI-powered IDE assistant, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Skills are scanned under the configuration directory (default .trae in the user's home); pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://trae.ai/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"trae.skill":{"id":"trae.skill","name":"trae.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Trae skill","desc":"A single SKILL.md definition discovered for the Trae agent. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"ufw":{"id":"ufw","name":"ufw","fields":{"application":{"name":"application","type":"\u001bufw.application","title":"UFW application profile from /etc/ufw/applications.d/","desc":"Named application profile that maps a service to the ports it needs, so UFW rules can reference it by name instead of listing ports. Each profile carries a `name` (for example \"Nginx Full\"), a human-readable `title` and `description`, and the `ports` specification it opens.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"applications":{"name":"applications","type":"\u0019\u001bufw.application","title":"Application profiles from /etc/ufw/applications.d/","provider":"go.mondoo.com/cnquery/v9/providers/os"},"defaultIncoming":{"name":"defaultIncoming","type":"\u0007","title":"Default policy for incoming traffic (e.g., \"deny\", \"allow\", \"reject\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"defaultOutgoing":{"name":"defaultOutgoing","type":"\u0007","title":"Default policy for outgoing traffic (e.g., \"allow\", \"deny\", \"reject\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"defaultRouted":{"name":"defaultRouted","type":"\u0007","title":"Default policy for routed traffic (e.g., \"deny\", \"allow\", \"reject\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"logging":{"name":"logging","type":"\u0007","title":"Logging level (off, low, medium, high, full)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rule":{"name":"rule","type":"\u001bufw.rule","title":"Individual UFW rule","desc":"Single UFW rule as reported by `ufw status`, covering the action taken, the traffic direction, and the addresses, ports, protocol, and interface it matches. The `action` (ALLOW, DENY, REJECT, LIMIT), `direction`, and `port`/`from`/`to` fields together describe what the rule permits or blocks; `ipv6` flags IPv6 rules, and `raw` preserves the original text.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bufw.rule","title":"All UFW rules","provider":"go.mondoo.com/cnquery/v9/providers/os"},"status":{"name":"status","type":"\u0007","title":"Whether UFW is active (\"active\", \"inactive\", \"not installed\")","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"UFW (Uncomplicated Firewall) state and rules","desc":"Uncomplicated Firewall status, default policies, configured rules, and application profiles on Debian and Ubuntu systems. Check `status` to confirm the firewall is active, and the `defaultIncoming` / `defaultOutgoing` / `defaultRouted` policies for the baseline stance (a hardened host typically denies incoming by default). Enumerate `rules` to audit the explicit allow/deny entries and `applications` for the service profiles UFW can reference by name.","min_provider_version":"13.2.8","defaults":"status rules","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ufw.application":{"id":"ufw.application","name":"ufw.application","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the application","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Profile name (e.g., \"Nginx Full\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ports":{"name":"ports","type":"\u0007","is_mandatory":true,"title":"Port specification (e.g., \"80/tcp\", \"80,443/tcp\", \"80,443/tcp|443/udp\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Short title describing the application","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"UFW application profile from /etc/ufw/applications.d/","desc":"Named application profile that maps a service to the ports it needs, so UFW rules can reference it by name instead of listing ports. Each profile carries a `name` (for example \"Nginx Full\"), a human-readable `title` and `description`, and the `ports` specification it opens.","private":true,"min_provider_version":"13.2.8","defaults":"name ports","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ufw.rule":{"id":"ufw.rule","name":"ufw.rule","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action (ALLOW, DENY, REJECT, LIMIT)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"direction":{"name":"direction","type":"\u0007","is_mandatory":true,"title":"Direction (IN, OUT, FWD)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"from":{"name":"from","type":"\u0007","is_mandatory":true,"title":"Source address or subnet (e.g., \"192.168.1.0/24\", \"Anywhere\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"interface":{"name":"interface","type":"\u0007","is_mandatory":true,"title":"Network interface (e.g., \"eth0\"), empty if not specified","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ipv6":{"name":"ipv6","type":"\u0004","is_mandatory":true,"title":"Whether this is an IPv6 rule","provider":"go.mondoo.com/cnquery/v9/providers/os"},"number":{"name":"number","type":"\u0005","is_mandatory":true,"title":"Rule number (sequential across IPv4 and IPv6 rules; may differ from `ufw status numbered`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"port":{"name":"port","type":"\u0007","is_mandatory":true,"title":"Port or port range (e.g., \"22\", \"6000:6007\", \"any\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol (tcp, udp, any)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Raw rule text as reported by ufw","provider":"go.mondoo.com/cnquery/v9/providers/os"},"to":{"name":"to","type":"\u0007","is_mandatory":true,"title":"Destination address or subnet","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Individual UFW rule","desc":"Single UFW rule as reported by `ufw status`, covering the action taken, the traffic direction, and the addresses, ports, protocol, and interface it matches. The `action` (ALLOW, DENY, REJECT, LIMIT), `direction`, and `port`/`from`/`to` fields together describe what the rule permits or blocks; `ipv6` flags IPv6 rules, and `raw` preserves the original text.","private":true,"min_provider_version":"13.2.8","defaults":"action direction port","provider":"go.mondoo.com/cnquery/v9/providers/os"},"usb":{"id":"usb","name":"usb","fields":{"device":{"name":"device","type":"\u001busb.device","title":"Experimental: USB device","desc":"Single attached USB device. `vendorId` and `productId` identify the hardware model, `class`/`className` give its function (e.g. mass storage, HID, hub), `serial` uniquely identifies the unit where the device reports one, and `isRemovable` distinguishes hot-pluggable peripherals from fixed internal devices.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"experimental"},"devices":{"name":"devices","type":"\u0019\u001busb.device","title":"List of USB devices","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"USB device inventory (experimental)","desc":"USB devices attached to the host, each with its vendor and product IDs, manufacturer, serial number, device class, and connection speed. The `devices` list inventories connected peripherals so you can flag removable storage or unexpected hardware.","min_provider_version":"11.3.43","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"experimental"},"usb.device":{"id":"usb.device","name":"usb.device","fields":{"class":{"name":"class","type":"\u0007","is_mandatory":true,"title":"USB device class code (e.g., \"08\" for mass storage, \"03\" for HID)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"className":{"name":"className","type":"\u0007","is_mandatory":true,"title":"USB device class name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isRemovable":{"name":"isRemovable","type":"\u0004","is_mandatory":true,"title":"Removable device","provider":"go.mondoo.com/cnquery/v9/providers/os"},"manufacturer":{"name":"manufacturer","type":"\u0007","is_mandatory":true,"title":"USB manufacturer","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"USB device name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"productId":{"name":"productId","type":"\u0007","is_mandatory":true,"title":"USB device product id","provider":"go.mondoo.com/cnquery/v9/providers/os"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"USB protocol code within the device class","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serial":{"name":"serial","type":"\u0007","is_mandatory":true,"title":"USB device serial number","provider":"go.mondoo.com/cnquery/v9/providers/os"},"speed":{"name":"speed","type":"\u0007","is_mandatory":true,"title":"USB speed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"subclass":{"name":"subclass","type":"\u0007","is_mandatory":true,"title":"USB device subclass","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vendorId":{"name":"vendorId","type":"\u0007","is_mandatory":true,"title":"USB device vendor id","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"USB device version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Experimental: USB device","desc":"Single attached USB device. `vendorId` and `productId` identify the hardware model, `class`/`className` give its function (e.g. mass storage, HID, hub), `serial` uniquely identifies the unit where the device reports one, and `isRemovable` distinguishes hot-pluggable peripherals from fixed internal devices.","private":true,"min_provider_version":"11.3.43","defaults":"manufacturer name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"experimental"},"user":{"id":"user","name":"user","fields":{"authorizedkeys":{"name":"authorizedkeys","type":"\u001bauthorizedkeys","refs":["\"home\""],"title":"Parsed ~/.ssh/authorized_keys for this user","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the account is enabled (not locked or disabled)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"gid":{"name":"gid","type":"\u0005","is_mandatory":true,"title":"User's primary group ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"group":{"name":"group","type":"\u001bgroup","refs":["\"gid\""],"title":"The user's primary group","provider":"go.mondoo.com/cnquery/v9/providers/os"},"home":{"name":"home","type":"\u0007","is_mandatory":true,"title":"Home directory path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"loggedIn":{"name":"loggedIn","type":"\u0004","title":"Whether the user currently has an active login session","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the user","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ntuserDat":{"name":"ntuserDat","type":"\u0007","refs":["\"home\""],"title":"Path to this user's NTUSER.DAT registry hive file (Windows)","desc":"The per-user registry hive on disk, located at `\u003chome\u003e\\NTUSER.DAT`. Pass it together with `sid` to `registrykey`/`registrykey.property` to read a user's HKCU settings even when their hive is not loaded, for example a SYSTEM scan running with no interactive session. Empty on non-Windows platforms or when the home directory is unknown.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"shell":{"name":"shell","type":"\u0007","is_mandatory":true,"title":"Login shell configured for the user (e.g., /bin/bash, /usr/sbin/nologin)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sid":{"name":"sid","type":"\u0007","is_mandatory":true,"title":"User's security identifier (Windows)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sshkeys":{"name":"sshkeys","type":"\u0019\u001bprivatekey","title":"Private SSH keys discovered in the user's home directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uid":{"name":"uid","type":"\u0005","is_mandatory":true,"title":"User ID","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"User account on the system","desc":"Single local user account: numeric UID and primary GID (Windows SID where applicable), name, home directory, configured login shell, and an `enabled` flag. Surfaces the primary `group` reference, the `authorizedkeys` resource that parses the user's `~/.ssh/authorized_keys`, the SSH private keys discovered in the user's home, and a `loggedIn` predicate that reflects whether the user currently has an active session. Used for identity audits, dormant-account hygiene, and SSH-key inventories.","min_provider_version":"9.0.0","defaults":"name uid gid","provider":"go.mondoo.com/cnquery/v9/providers/os"},"users":{"id":"users","name":"users","fields":{"list":{"name":"list","type":"\u0019\u001buser","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"list_type":"\u001buser","title":"All user accounts configured on the system","desc":"Collection of every local `user` on the asset. The entry point for fleet-wide identity audits, e.g. asserting that every account with UID \u003c 1000 is enabled, that no account shares another's home directory, or that no human user has the shell set to `/bin/bash` outside an approved list.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vscode":{"id":"vscode","name":"vscode","fields":{"extension":{"name":"extension","type":"\u001bvscode.extension","title":"Visual Studio Code extension","desc":"Single installed editor extension, read from its package.json. Records the `identifier` (publisher.name), `version`, `publisher`, and the `editor` it belongs to, plus a Package URL (`purl`) for correlating the extension against vulnerability and advisory feeds.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"extensions":{"name":"extensions","type":"\u0019\u001bvscode.extension","title":"All installed VS Code extensions across all users","provider":"go.mondoo.com/cnquery/v9/providers/os"},"paths":{"name":"paths","type":"\u0019\u0007","title":"Paths searched for VS Code extensions","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Visual Studio Code (and forks)","desc":"Installed editor extensions discovered across all users for VS Code and compatible forks (Cursor, Windsurf, and similar). Iterate `extensions` to inventory what is installed per editor, review publishers and versions, and identify untrusted or outdated extensions. `paths` lists the extension directories that were searched.","min_provider_version":"11.4.86","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vscode.extension":{"id":"vscode.extension","name":"vscode.extension","fields":{"categories":{"name":"categories","type":"\u0019\u0007","is_mandatory":true,"title":"Extension categories","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Extension description from package.json","provider":"go.mondoo.com/cnquery/v9/providers/os"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Extension display name from package.json","provider":"go.mondoo.com/cnquery/v9/providers/os"},"editor":{"name":"editor","type":"\u0007","is_mandatory":true,"title":"Editor application (e.g., Visual Studio Code, Cursor, Windsurf)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"Unique extension identifier (publisher.name format)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Extension name from package.json","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the extension directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"publisher":{"name":"publisher","type":"\u0007","is_mandatory":true,"title":"Extension publisher from package.json","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","title":"Package URL","desc":"Package URL identifying the extension in the form pkg:vscode-extension/\u003cpublisher\u003e/\u003cname\u003e@\u003cversion\u003e, per https://github.com/package-url/purl-spec/blob/main/types-doc/vscode-extension-definition.md","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Extension version from package.json","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vscodeVersion":{"name":"vscodeVersion","type":"\u0007","is_mandatory":true,"title":"VS Code engine version compatibility","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Visual Studio Code extension","desc":"Single installed editor extension, read from its package.json. Records the `identifier` (publisher.name), `version`, `publisher`, and the `editor` it belongs to, plus a Package URL (`purl`) for correlating the extension against vulnerability and advisory feeds.","private":true,"min_provider_version":"11.4.86","defaults":"editor name version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vuln":{"id":"vuln","fields":{"advisory":{"name":"advisory","type":"\u001bvuln.advisory","title":"Advisory information","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"cve":{"name":"cve","type":"\u001bvuln.cve","title":"CVE information","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"package":{"name":"package","type":"\u001bvuln.package","title":"Package information relevant for vulnerability management","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"vuln.advisory":{"id":"vuln.advisory","name":"vuln.advisory","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the advisory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Advisory ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modified":{"name":"modified","type":"\t","is_mandatory":true,"title":"Last modification date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"published":{"name":"published","type":"\t","is_mandatory":true,"title":"Advisory publication date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Title of the advisory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"worstScore":{"name":"worstScore","type":"\u001baudit.cvss","is_mandatory":true,"title":"Worst CVSS score of all assigned CVEs","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Advisory information","private":true,"min_provider_version":"9.1.15","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vuln.cve":{"id":"vuln.cve","name":"vuln.cve","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"CVE ID (e.g., \"CVE-2024-3094\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"modified":{"name":"modified","type":"\t","is_mandatory":true,"title":"Last modification date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"published":{"name":"published","type":"\t","is_mandatory":true,"title":"Publication date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"CVE state","provider":"go.mondoo.com/cnquery/v9/providers/os"},"summary":{"name":"summary","type":"\u0007","is_mandatory":true,"title":"Summary description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"unscored":{"name":"unscored","type":"\u0004","is_mandatory":true,"title":"Whether the CVE has no assigned CVSS score","provider":"go.mondoo.com/cnquery/v9/providers/os"},"worstScore":{"name":"worstScore","type":"\u001baudit.cvss","is_mandatory":true,"title":"Worst CVSS score of all assigned CVEs","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"CVE information","private":true,"min_provider_version":"9.1.15","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vuln.package":{"id":"vuln.package","name":"vuln.package","fields":{"arch":{"name":"arch","type":"\u0007","is_mandatory":true,"title":"Architecture of this package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"available":{"name":"available","type":"\u0007","is_mandatory":true,"title":"Fixed package version that resolves the vulnerability, when available","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Package name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Currently installed package version","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Package information relevant for vulnerability management","private":true,"min_provider_version":"9.1.15","defaults":"name version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vulnmgmt":{"id":"vulnmgmt","name":"vulnmgmt","fields":{"advisories":{"name":"advisories","type":"\u0019\u001bvuln.advisory","title":"List of all advisories affecting the asset","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cves":{"name":"cves","type":"\u0019\u001bvuln.cve","title":"List of all CVEs affecting the asset","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastAssessment":{"name":"lastAssessment","type":"\t","title":"Last time the vulnerability information was updated","provider":"go.mondoo.com/cnquery/v9/providers/os"},"packages":{"name":"packages","type":"\u0019\u001bvuln.package","title":"List of all packages affected by vulnerabilities","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stats":{"name":"stats","type":"\u001baudit.cvss","title":"Rolled-up CVSS statistics across all findings","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Asset vulnerability assessment","desc":"Vulnerability data Mondoo derives for an asset by joining its installed-package inventory and platform identity against the curated CVE and advisory feed. Exposes every CVE affecting the asset, every vendor advisory that mentions one of those CVEs, the affected packages with their currently-installed and patched-available versions, the timestamp of the last assessment run, and the rolled-up CVSS statistics: the surface used to score asset risk and to drive patch-status policies.","min_provider_version":"9.1.15","provider":"go.mondoo.com/cnquery/v9/providers/os"},"warp":{"id":"warp","name":"warp","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Warp configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional; null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bwarp.skill","title":"Warp skill","desc":"A single SKILL.md definition discovered for Warp under the shared .agents/skills directory. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bwarp.skill","title":"Skills installed for the agent, one resource per discovered SKILL.md file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Warp AI terminal instance","desc":"Warp, an AI-powered terminal, installed on the target. Reports its presence and version via package, the host it runs in via runtime, and the SKILL.md definitions installed for it via skills. Warp reads skills from the shared .agents/skills directory in each user's home rather than its own .warp config directory; pass configPath to target a non-default install. Auditing this resource shows whether the agent is present and what skills extend it. URL: https://www.warp.dev/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"warp.skill":{"id":"warp.skill","name":"warp.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","desc":"Tool identifiers parsed from the frontmatter `allowed-tools` field (a comma-separated list), naming the capabilities the skill may invoke such as file edits, shell commands, or web access. Empty when the skill declares no restriction. The key field for reviewing what an installed skill is permitted to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint for expected arguments","desc":"Usage hint from the frontmatter `argument-hint` field, shown when the skill is invoked. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full raw content of the SKILL.md file","desc":"Complete Markdown body of the skill, including the YAML frontmatter and the prose instructions the agent follows. Inspect it to review exactly what an installed skill tells the agent to do.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","desc":"Free-text summary from the frontmatter `description` field, stating what the skill does and when the agent should invoke it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","desc":"Name from the SKILL.md YAML frontmatter `name` field, falling back to the skill's directory name when the frontmatter omits it.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content","desc":"Hex-encoded SHA-256 digest of content, for detecting drift or pinning a known-good skill definition against a baseline.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Filesystem path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Warp skill","desc":"A single SKILL.md definition discovered for Warp under the shared .agents/skills directory. Each skill is a Markdown file with YAML frontmatter that adds instructions and tool access to the assistant; auditing them surfaces the capabilities granted.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"windows":{"id":"windows","name":"windows","fields":{"auditPolicy":{"name":"auditPolicy","type":"\u001bwindows.auditPolicy","title":"Windows advanced audit policy","desc":"Effective Windows advanced audit policy: every audit subcategory together with whether success and failure events are audited. Subcategory names and categories are reported in English regardless of the OS display language, so the same audit works unchanged on localized systems. Iterate the subcategories to assert audit coverage, for example `windows.auditPolicy.where(category == \"Account Logon\").all(success)`, or select a single subcategory with windows.auditPolicy.subcategory.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"bitlocker":{"name":"bitlocker","type":"\u001bwindows.bitlocker","title":"Windows BitLocker drive encryption","desc":"BitLocker Drive Encryption state across volumes: the encryption, lock, and protection status of each `volume`, plus the BitLocker Group Policy (FVE) settings under `policy`. Use it to verify that OS and data drives are encrypted and protected.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"computerInfo":{"name":"computerInfo","type":"\n","title":"A consolidated object of system and operating system properties","desc":"See https://learn.microsoft.com/en-us/dotnet/api/microsoft.powershell.commands.computerinfo?view=powershellsdk-1.1.0 for more information.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"defender":{"name":"defender","type":"\u001bwindows.defender","title":"Microsoft Defender Antivirus","desc":"Complete runtime status and configuration of Microsoft Defender Antivirus, so policies can assert on every Defender security control. The `status` field exposes the live engine, signature, and protection state reported by Get-MpComputerStatus (real-time protection, behavior monitoring, network inspection, tamper protection, scan ages, and signature freshness). The `preferences` field exposes the configurable policy reported by Get-MpPreference, grouped into scan, real-time, cloud-delivered protection, signature-update, threat-action, controlled-folder-access, network-protection, and remediation settings, plus exclusions and Attack Surface Reduction rules. The `threats` and `threatDetections` fields expose the recorded threat history. On systems without Defender (for example servers running a third-party antivirus) these fields resolve to null rather than failing the query.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"deviceGuard":{"name":"deviceGuard","type":"\u001bwindows.deviceGuard","title":"Device Guard policy (Virtualization-Based Security, HVCI, and Credential Guard)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"eventlog":{"name":"eventlog","type":"\u001bwindows.eventlog","title":"Windows Event Log channel configuration","desc":"Size and retention policy of a single Windows Event Log channel. The `name` field selects the channel as it appears under the EventLog registry tree, for example `windows.eventlog(name: \"Security\")` or `windows.eventlog(name: \"Application\")`. `maxSizeKB` reports the maximum log file size in KB and `retention` decodes how the channel behaves when that size is reached. Each field resolves the Group Policy value first, then the effective channel configuration, and finally the documented Windows default when neither is set.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"exploitProtection":{"name":"exploitProtection","type":"\u001bwindows.exploitProtection","title":"System-wide Windows Exploit Protection configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"firewall":{"name":"firewall","type":"\u001bwindows.firewall","title":"Windows Firewall (Advanced Security)","desc":"Windows Firewall with Advanced Security posture: the global settings, the per-profile defaults (Domain, Private, Public), and every configured firewall rule. Use `profiles` to assert that the firewall is enabled and blocks inbound traffic by default on each profile, and `rules` to audit which allow/block rules are active. Backed by the `Get-NetFirewallProfile` and `Get-NetFirewallRule` PowerShell cmdlets.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"hotfix":{"name":"hotfix","type":"\u001bwindows.hotfix","title":"Windows hotfix","desc":"Single installed Windows hotfix (a Quick Fix Engineering update): its `hotfixId` (for example \"KB5034441\"), the `description` type of the fix, the knowledge-base `caption` URL, the `installedOn` date, and the account that installed it. Audit patch compliance across `windows.hotfixes`, for example `windows.hotfixes.where(installedOn \u003e time.now - 30*time.day)`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"hotfixes":{"name":"hotfixes","type":"\u0019\u001bwindows.hotfix","title":"Hotfixes installed on the computer","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lsa":{"name":"lsa","type":"\u001bwindows.lsa","title":"Windows Local Security Authority (LSA) security policy","desc":"Local Security Authority configuration that backs the \"Network access\", \"Network security\", and related security options under HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa. These values control anonymous access restrictions, blank-password use, LAN Manager authentication level, NTLM hashing, LSA protection (RunAsPPL), and audit behavior. On/off settings are exposed as booleans and graded settings (such as the LAN Manager authentication level) as integers. NTLM (MSV1_0 and WDigest) settings are grouped under `ntlm` and the Netlogon secure-channel settings under `secureChannel`. Values are nullable: an absent value resolves to null so it is distinguishable from an explicit false or 0, letting checks assert on configured-vs-default precisely.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"optionalFeature":{"name":"optionalFeature","type":"\u001bwindows.optionalFeature","title":"Windows optional feature (desktop-only)","desc":"Windows optional feature reported by `Get-WindowsOptionalFeature -Online`, the desktop equivalent of server roles. Select one by its feature name, for example `windows.optionalFeature(name: \"SMB1Protocol\")`, to check whether a legacy or risky feature (such as SMBv1, Telnet client, or PowerShell v2) is turned on. `enabled` is the simple boolean; `state` carries the underlying DISM feature state for more granular checks.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"optionalFeatures":{"name":"optionalFeatures","type":"\u0019\u001bwindows.optionalFeature","title":"Information about optional features in a Windows image.","min_provider_version":"11.2.6","provider":"go.mondoo.com/cnquery/v9/providers/os"},"powershell":{"name":"powershell","type":"\u001bwindows.powershell","title":"Windows PowerShell logging policy","desc":"PowerShell logging settings configured via Group Policy under HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell: Script Block Logging, Transcription, and the machine execution policy. These are GPO-only values with no effective fallback, so when a value is absent the corresponding field is null, which is distinguishable from an explicit 0. Read from the registry, so it is available even on connections that cannot run commands.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"rdp":{"name":"rdp","type":"\u001bwindows.rdp","title":"Windows Remote Desktop / Terminal Services configuration","desc":"Effective Remote Desktop (Terminal Services) policy posture: whether Network Level Authentication is required, the negotiated security layer and minimum client encryption level, device and resource redirection toggles, credential handling, and session idle / disconnection time limits. Each field resolves the Group Policy value (HKLM\\SOFTWARE\\Policies\\Microsoft \\Windows NT\\Terminal Services) first, then the per-listener configuration (HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp), and finally the documented Windows default when neither is set, so audits can assert the effective state without handling missing registry values.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"schannel":{"name":"schannel","type":"\u001bwindows.schannel","title":"Windows Schannel TLS configuration","desc":"Schannel (Secure Channel) TLS cipher-suite and supported-group configuration that backs the Microsoft TLS/SSL stack, read from the effective local Schannel store under HKLM\\SYSTEM\\CurrentControlSet\\Control\\Cryptography\\Configuration\\Local\\SSL. The ordered cipher-suite list is the REG_MULTI_SZ `Functions` value under the 00010002 subkey and the ordered elliptic-curve / supported-group list is the REG_MULTI_SZ `Functions` value under the 00010003 subkey. On Windows 11 24H2 and Windows Server 2025 the supported-group list is where post-quantum ML-KEM key-exchange groups (for example secp256r1_mlkem768) appear once enabled.  When a key or value is absent (the common case on older Windows, on systems using the default order, and on non-Windows platforms) the list accessors resolve to an empty list and pqcKeyExchangeEnabled resolves to false rather than failing.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"scheduledTask":{"name":"scheduledTask","type":"\u001bwindows.scheduledTask","title":"Windows Task Scheduler task","desc":"Registered task from the Windows Task Scheduler: its identity (`name`, `path`, `uri`), run `state`, whether it is `enabled`, descriptive metadata (`description`, `author`), and the security context it runs under via `principal`. The `actions` it executes, the `triggers` that launch it, and its full `settings` are exposed as nested resources, while `lastRunTime`, `nextRunTime`, `lastTaskResult`, and `missedRuns` report the most recent run-time information. Audit which tasks run, as whom, and on what schedule, for example `windows.scheduledTasks.where(enabled).where(principal.runLevel == \"Highest\")` surfaces enabled tasks running with the highest available privileges.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"scheduledTasks":{"name":"scheduledTasks","type":"\u0019\u001bwindows.scheduledTask","title":"Registered Windows Task Scheduler tasks","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"security":{"name":"security","type":"\u001bwindows.security","title":"Windows registered security products","desc":"Antivirus, anti-spyware, and firewall providers registered with the Windows Security Center. Use `products` to verify that an up-to-date, enabled security product is present, for example `windows.security.products.where(type == \"antivirus\").any(productState == \"on\")`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"serverFeature":{"name":"serverFeature","type":"\u001bwindows.serverFeature","title":"Windows Server role, role service, or feature","desc":"Installable Windows Server component reported by `Get-WindowsFeature`. Select one by its command name, for example `windows.serverFeature(name: \"Web-Server\")`, to check whether a role such as IIS, DNS, or Hyper-V is present. `installed` is the simple boolean check, while `installState` distinguishes fully installed from removed or available-for-install states.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"serverFeatures":{"name":"serverFeatures","type":"\u0019\u001bwindows.serverFeature","title":"Information about Windows Server roles, role services, and features that are available for installation and installed on a specified server.","min_provider_version":"11.2.6","provider":"go.mondoo.com/cnquery/v9/providers/os"},"smartScreen":{"name":"smartScreen","type":"\u001bwindows.smartScreen","title":"Microsoft Defender SmartScreen policy","provider":"go.mondoo.com/cnquery/v9/providers/os"},"smb":{"name":"smb","type":"\u001bwindows.smb","title":"Windows SMB (Server Message Block) server","desc":"SMB shares published by the host, active inbound client sessions, and outbound connections to other SMB servers, along with the server and client registry hardening configuration and whether the deprecated SMBv1 driver is still enabled. Backed by the `Get-SmbShare`, `Get-SmbSession`, and `Get-SmbConnection` PowerShell cmdlets plus registry reads.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"spooler":{"name":"spooler","type":"\u001bwindows.spooler","title":"Windows Print Spooler security configuration","desc":"Hardening-relevant state of the Windows Print Spooler and printing subsystem. The fields are sourced from the Group Policy printer keys under HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers (and its PointAndPrint, RPC, IPP, and WPP subkeys), the machine-wide HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print key, and the spooler service start configuration under HKLM\\SYSTEM\\CurrentControlSet\\Services\\Spooler. These controls address the PrintNightmare and related spooler vulnerabilities: whether the service is disabled, whether remote RPC is accepted, and how Point-and-Print driver installation is restricted.  Integer settings that are not present in the registry resolve to null so \"not configured\" is distinguishable from an explicit value of 0 (important because several controls, for example registerRemoteRpcEndpoint == 0, are compliant precisely when set to 0). Boolean settings resolve to their documented Windows default when the value is absent.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"telemetry":{"name":"telemetry","type":"\u001bwindows.telemetry","title":"Windows diagnostic data (telemetry) and consumer cloud-content policy","desc":"Effective Windows privacy and telemetry posture read from the Group Policy keys HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection and HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent. These are GPO-only DWORD values. The diagnostic data level is a graded integer; the remaining settings are on/off booleans. Every field is nullable so that an absent value (the policy is not configured) is distinguishable from an explicit false or 0. Read from the registry, so it is available even on connections that cannot run commands.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"tpm":{"name":"tpm","type":"\u001bwindows.tpm","title":"Windows Trusted Platform Module (TPM)","desc":"Trusted Platform Module state: whether a TPM is present, ready for use, enabled, and activated, along with its major specification version and manufacturer version string. Presence and a 2.0 specification version are prerequisites for Windows 11 readiness and several BitLocker and device-health controls. On a system without a TPM the fields resolve cleanly (present is false) rather than erroring.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"update":{"name":"update","type":"\u001bwindows.update","title":"Windows Update Agent","desc":"How a Windows host receives updates and what it has applied or has pending. The `config` field surfaces Windows Update Agent configuration and freshness (the effective catalog source, WSUS settings, the last successful detection / download / install times, and whether a reboot is pending). `installed` lists the updates the agent has applied (the installed-KB history), and `available` lists updates the agent has found but not yet installed. Configuration is read from the registry and works even on connections that cannot run commands; the installed and available collections fall back to the Windows Update Agent COM API when commands are available.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"winrm":{"name":"winrm","type":"\u001bwindows.winrm","title":"Windows Remote Management (WinRM)","desc":"Effective WinRM (Windows Remote Management) policy posture for both the WinRM client and service, plus the WinRS remote shell setting and the WinRM service start mode. The client and service settings are read from the Group Policy key HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\WinRM; these are GPO-only values with no per-listener effective fallback, so when a value is absent the documented Windows default applies. `serviceStartMode` reflects HKLM\\SYSTEM\\CurrentControlSet\\Services\\WinRM\\Start. Read from the registry, so it is available even on connections that cannot run commands.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"title":"Windows-specific operating system surfaces","desc":"Windows host settings not covered by the cross-platform resources: consolidated `computerInfo`, installed `hotfixes`, Server roles and features, image `optionalFeatures`, scheduled tasks, and hardening controls (Device Guard, Exploit Protection, SmartScreen). A starting point for Windows-specific audits.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.auditPolicy":{"id":"windows.auditPolicy","name":"windows.auditPolicy","fields":{"list":{"name":"list","type":"\u0019\u001bwindows.auditPolicy.subcategory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"subcategory":{"name":"subcategory","type":"\u001bwindows.auditPolicy.subcategory","title":"Windows audit policy subcategory","desc":"Audit settings of a single advanced audit policy subcategory. The `name` field selects the subcategory by its English name, for example `windows.auditPolicy.subcategory(name: \"Logon\")`, and also accepts a subcategory GUID or the localized name the system reports. `success` and `failure` indicate whether the subcategory audits success and failure events, derived from the reported audit setting independent of the OS display language. A subcategory that is not present on the system audits nothing (`success` and `failure` are false and the reported fields are null) so checks against it fail rather than error.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"list_type":"\u001bwindows.auditPolicy.subcategory","title":"Windows advanced audit policy","desc":"Effective Windows advanced audit policy: every audit subcategory together with whether success and failure events are audited. Subcategory names and categories are reported in English regardless of the OS display language, so the same audit works unchanged on localized systems. Iterate the subcategories to assert audit coverage, for example `windows.auditPolicy.where(category == \"Account Logon\").all(success)`, or select a single subcategory with windows.auditPolicy.subcategory.","min_provider_version":"13.28.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.auditPolicy.subcategory":{"id":"windows.auditPolicy.subcategory","name":"windows.auditPolicy.subcategory","fields":{"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Audit category the subcategory belongs to (e.g. `Logon/Logoff`)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exclusionSetting":{"name":"exclusionSetting","type":"\u0007","is_mandatory":true,"title":"Per-user audit exclusion setting as reported by the system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"failure":{"name":"failure","type":"\u0004","is_mandatory":true,"title":"Whether failure events are audited","provider":"go.mondoo.com/cnquery/v9/providers/os"},"guid":{"name":"guid","type":"\u0007","is_mandatory":true,"title":"GUID that identifies the subcategory across Windows versions and languages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"inclusionSetting":{"name":"inclusionSetting","type":"\u0007","is_mandatory":true,"title":"Audit setting as reported by the system in its display language","desc":"One of `Success`, `Failure`, `Success and Failure`, or `No Auditing`, localized to the OS display language.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"localizedName":{"name":"localizedName","type":"\u0007","is_mandatory":true,"title":"Subcategory name as reported by the system in its display language","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Subcategory name in English (e.g. `Logon`), stable across OS display languages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"success":{"name":"success","type":"\u0004","is_mandatory":true,"title":"Whether success events are audited","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Windows audit policy subcategory","desc":"Audit settings of a single advanced audit policy subcategory. The `name` field selects the subcategory by its English name, for example `windows.auditPolicy.subcategory(name: \"Logon\")`, and also accepts a subcategory GUID or the localized name the system reports. `success` and `failure` indicate whether the subcategory audits success and failure events, derived from the reported audit setting independent of the OS display language. A subcategory that is not present on the system audits nothing (`success` and `failure` are false and the reported fields are null) so checks against it fail rather than error.","min_provider_version":"13.28.2","defaults":"name success failure","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.bitlocker":{"id":"windows.bitlocker","name":"windows.bitlocker","fields":{"policy":{"name":"policy","type":"\u001bwindows.bitlocker.policy","title":"BitLocker Group Policy (FVE) settings configured for this system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"volume":{"name":"volume","type":"\u001bwindows.bitlocker.volume","title":"Windows BitLocker volume","desc":"Single BitLocker-managed volume: the `deviceID`, `driveLetter`, `conversionStatus` (encryption/decryption progress), `encryptionMethod` (algorithm and key size), `lockStatus` (0 = accessible, 1 = locked), `persistentVolumeID`, `protectionStatus` (0 = off, 1 = on, 2 = unknown), and BitLocker `version`. Iterated from `windows.bitlocker.volumes`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"volumes":{"name":"volumes","type":"\u0019\u001bwindows.bitlocker.volume","title":"Windows BitLocker volumes","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows BitLocker drive encryption","desc":"BitLocker Drive Encryption state across volumes: the encryption, lock, and protection status of each `volume`, plus the BitLocker Group Policy (FVE) settings under `policy`. Use it to verify that OS and data drives are encrypted and protected.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.bitlocker.policy":{"id":"windows.bitlocker.policy","name":"windows.bitlocker.policy","fields":{"disableExternalDmaUnderLock":{"name":"disableExternalDmaUnderLock","type":"\u0004","is_mandatory":true,"title":"Whether new DMA devices are disabled when this computer is locked (DisableExternalDMAUnderLock)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"driveSettings":{"name":"driveSettings","type":"\u001bwindows.bitlocker.policy.driveSettings","title":"Windows BitLocker per-drive-type Group Policy (FVE) settings","desc":"BitLocker policy values that apply to a single drive type (operating system, fixed data, or removable data). Fields that the drive type does not define, or that are not configured, are null. For example, operating system drives have no `allowUserCert`, and only removable data drives define `denyCrossOrg` and `denyWriteAccess`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"enableBdeWithNoTpm":{"name":"enableBdeWithNoTpm","type":"\u0004","is_mandatory":true,"title":"Whether BitLocker is allowed without a compatible TPM (EnableBDEWithNoTPM)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fixedDataDrives":{"name":"fixedDataDrives","type":"\u001bwindows.bitlocker.policy.driveSettings","title":"BitLocker policy settings for fixed data drives (FDV* values)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"operatingSystemDrives":{"name":"operatingSystemDrives","type":"\u001bwindows.bitlocker.policy.driveSettings","title":"BitLocker policy settings for operating system drives (OS* values)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"osAllowSecureBootForIntegrity":{"name":"osAllowSecureBootForIntegrity","type":"\u0004","is_mandatory":true,"title":"Whether Secure Boot is allowed for integrity validation on operating system drives (OSAllowSecureBootForIntegrity)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"removableDataDrives":{"name":"removableDataDrives","type":"\u001bwindows.bitlocker.policy.driveSettings","title":"BitLocker policy settings for removable data drives (RDV* values)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"useAdvancedStartup":{"name":"useAdvancedStartup","type":"\u0004","is_mandatory":true,"title":"Whether additional authentication is required at startup (UseAdvancedStartup)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"useEnhancedPin":{"name":"useEnhancedPin","type":"\u0004","is_mandatory":true,"title":"Whether enhanced PINs for startup are allowed (UseEnhancedPin)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows BitLocker Group Policy (FVE) settings","desc":"BitLocker Drive Encryption Group Policy settings stored under `HKLM\\SOFTWARE\\Policies\\Microsoft\\FVE`. Global settings are exposed directly; per-drive-type settings are grouped under `operatingSystemDrives`, `fixedDataDrives`, and `removableDataDrives`. A field is null when the corresponding policy value is not configured.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.bitlocker.policy.driveSettings":{"id":"windows.bitlocker.policy.driveSettings","name":"windows.bitlocker.policy.driveSettings","fields":{"activeDirectoryBackup":{"name":"activeDirectoryBackup","type":"\u0004","is_mandatory":true,"title":"Whether BitLocker recovery information is saved to Active Directory Domain Services (*ActiveDirectoryBackup)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"activeDirectoryInfoToStore":{"name":"activeDirectoryInfoToStore","type":"\u0005","is_mandatory":true,"title":"Configure what BitLocker recovery information is stored in AD DS (*ActiveDirectoryInfoToStore)","desc":"1 = store recovery passwords and key packages, 2 = store recovery passwords only. Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowUserCert":{"name":"allowUserCert","type":"\u0004","is_mandatory":true,"title":"Whether a certificate-based data recovery agent / smart card is allowed (*AllowUserCert)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"denyCrossOrg":{"name":"denyCrossOrg","type":"\u0004","is_mandatory":true,"title":"Whether write access is denied to devices configured in another organization (RDVDenyCrossOrg)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"denyWriteAccess":{"name":"denyWriteAccess","type":"\u0004","is_mandatory":true,"title":"Whether write access is denied to removable drives not protected by BitLocker (RDVDenyWriteAccess)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"discoveryVolumeType":{"name":"discoveryVolumeType","type":"\u0007","is_mandatory":true,"title":"Configure the format used when a drive is auto-unlocked / discovery volume type (*DiscoveryVolumeType)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"driveType":{"name":"driveType","type":"\u0007","is_mandatory":true,"title":"Drive type these settings apply to: operatingSystem, fixedData, or removableData","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enforceUserCert":{"name":"enforceUserCert","type":"\u0004","is_mandatory":true,"title":"Whether a certificate-based data recovery agent / smart card is enforced (*EnforceUserCert)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hardwareEncryption":{"name":"hardwareEncryption","type":"\u0005","is_mandatory":true,"title":"Configure use of hardware-based encryption (*HardwareEncryption)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hideRecoveryPage":{"name":"hideRecoveryPage","type":"\u0004","is_mandatory":true,"title":"Whether recovery options are omitted from the BitLocker setup wizard (*HideRecoveryPage)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"manageDRA":{"name":"manageDRA","type":"\u0004","is_mandatory":true,"title":"Whether a data recovery agent is allowed (*ManageDRA)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"passphrase":{"name":"passphrase","type":"\u0005","is_mandatory":true,"title":"Configure use of passwords (*Passphrase)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"recovery":{"name":"recovery","type":"\u0005","is_mandatory":true,"title":"Choose how BitLocker-protected drives can be recovered (*Recovery)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"recoveryKey":{"name":"recoveryKey","type":"\u0005","is_mandatory":true,"title":"Allow 256-bit recovery key (*RecoveryKey)","desc":"0 = disallow, 1 = require, 2 = allow. Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"recoveryPassword":{"name":"recoveryPassword","type":"\u0005","is_mandatory":true,"title":"Allow 48-digit recovery password (*RecoveryPassword)","desc":"0 = disallow, 1 = require, 2 = allow. Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"requireActiveDirectoryBackup":{"name":"requireActiveDirectoryBackup","type":"\u0004","is_mandatory":true,"title":"Whether BitLocker is blocked until recovery information is stored in AD DS (*RequireActiveDirectoryBackup)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows BitLocker per-drive-type Group Policy (FVE) settings","desc":"BitLocker policy values that apply to a single drive type (operating system, fixed data, or removable data). Fields that the drive type does not define, or that are not configured, are null. For example, operating system drives have no `allowUserCert`, and only removable data drives define `denyCrossOrg` and `denyWriteAccess`.","private":true,"min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.bitlocker.volume":{"id":"windows.bitlocker.volume","name":"windows.bitlocker.volume","fields":{"conversionStatus":{"name":"conversionStatus","type":"\n","is_mandatory":true,"title":"Status of the encryption or decryption on the volume","provider":"go.mondoo.com/cnquery/v9/providers/os"},"deviceID":{"name":"deviceID","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the volume","provider":"go.mondoo.com/cnquery/v9/providers/os"},"driveLetter":{"name":"driveLetter","type":"\u0007","is_mandatory":true,"title":"Drive letter of the volume","provider":"go.mondoo.com/cnquery/v9/providers/os"},"encryptionMethod":{"name":"encryptionMethod","type":"\n","is_mandatory":true,"title":"Encryption algorithm and key size used on the volume","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lockStatus":{"name":"lockStatus","type":"\u0005","is_mandatory":true,"title":"Whether the contents of the volume are accessible from Windows","desc":"0 = Full contents of the volume are accessible 1 = All or a portion of the contents of the volume are not accessible","provider":"go.mondoo.com/cnquery/v9/providers/os"},"persistentVolumeID":{"name":"persistentVolumeID","type":"\u0007","is_mandatory":true,"title":"Persistent identifier for the volume on this system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"protectionStatus":{"name":"protectionStatus","type":"\n","is_mandatory":true,"title":"Status of the volume, whether or not BitLocker is protecting the volume","desc":"0 = Protection off 1 = Protection on 2 = Protection unknown","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\n","is_mandatory":true,"title":"BitLocker Full Volume Encryption metadata version of the volume","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows BitLocker volume","desc":"Single BitLocker-managed volume: the `deviceID`, `driveLetter`, `conversionStatus` (encryption/decryption progress), `encryptionMethod` (algorithm and key size), `lockStatus` (0 = accessible, 1 = locked), `persistentVolumeID`, `protectionStatus` (0 = off, 1 = on, 2 = unknown), and BitLocker `version`. Iterated from `windows.bitlocker.volumes`.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender":{"id":"windows.defender","name":"windows.defender","fields":{"asrRule":{"name":"asrRule","type":"\u001bwindows.defender.asrRule","title":"Microsoft Defender Attack Surface Reduction rule","desc":"Single Attack Surface Reduction (ASR) rule: its `id` (the rule GUID), the friendly `name` when the GUID is recognized, and the configured `action`. The `id` selects the rule, for example `windows.defender.preferences.attackSurfaceReductionRules.where(id == \"...\")`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"behavioralNetworkBlockSettings":{"name":"behavioralNetworkBlockSettings","type":"\u001bwindows.defender.behavioralNetworkBlockSettings","title":"Microsoft Defender behavioral network block settings","desc":"Behavioral network protection preferences that block attacks observed from the network: brute-force protection (against password-guessing attacks) and remote-encryption protection (against remote ransomware encryption). Each exposes its configured state, aggressiveness, and maximum block time.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"cloudSettings":{"name":"cloudSettings","type":"\u001bwindows.defender.cloudSettings","title":"Microsoft Defender cloud-delivered protection settings","desc":"Microsoft Active Protection Service (MAPS) and cloud-delivered protection preferences: the reporting membership level, the sample-submission consent, the cloud block level and extended timeout, and the block-at-first-seen toggle. Together these control how much Defender relies on the cloud for rapid detection of new threats.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"controlledFolderAccess":{"name":"controlledFolderAccess","type":"\u001bwindows.defender.controlledFolderAccess","title":"Microsoft Defender controlled folder access settings","desc":"Controlled-folder-access (ransomware protection) configuration: whether it is enabled or in audit mode, the applications allowed to write to protected folders, and the list of additional protected folders beyond the system defaults.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"enabled":{"name":"enabled","type":"\u0004","title":"Whether the Defender antimalware service and real-time antivirus and antispyware protection are all active","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exclusions":{"name":"exclusions","type":"\u001bwindows.defender.exclusions","title":"Microsoft Defender scan exclusions","desc":"Every configured scan exclusion: file and folder `paths`, file `extensions`, `processes`, and `ipAddresses`. Empty lists mean no exclusions of that kind are configured. Exclusions are a common misconfiguration and malware-persistence vector, so audits often verify that these lists are empty or tightly scoped.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"localSettingOverrides":{"name":"localSettingOverrides","type":"\u001bwindows.defender.localSettingOverrides","title":"Microsoft Defender local setting overrides","desc":"Whether a locally configured preference is allowed to override the corresponding Group Policy setting. When an override is disabled (false) the policy value is enforced and users cannot change it locally; CIS benchmarks generally require these overrides to be disabled.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"networkProtectionSettings":{"name":"networkProtectionSettings","type":"\u001bwindows.defender.networkProtectionSettings","title":"Microsoft Defender network protection settings","desc":"Network-protection configuration: the enforcement mode and the toggles that extend protection to Windows Server, down-level clients, and datagram processing, plus DNS sinkhole enforcement. Network protection blocks outbound connections to malicious domains and IP addresses.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"preferences":{"name":"preferences","type":"\u001bwindows.defender.preferences","title":"Configurable Defender preferences and policy (Get-MpPreference)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"realTimeSettings":{"name":"realTimeSettings","type":"\u001bwindows.defender.realTimeSettings","title":"Microsoft Defender real-time protection settings","desc":"Real-time protection preferences: the master real-time monitoring toggle, behavior monitoring, downloaded-file (IOAV) scanning, script scanning, on-access protection, the intrusion-prevention system, the scan direction, and file-hash computation. The toggles are phrased as \"disable\" flags, so false generally means the protection is on.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"remediationSettings":{"name":"remediationSettings","type":"\u001bwindows.defender.remediationSettings","title":"Microsoft Defender remediation settings","desc":"Threat-remediation preferences: the scheduled remediation day and time, how long quarantined items are retained before purging, and whether system restore points are created before remediation.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"scanSettings":{"name":"scanSettings","type":"\u001bwindows.defender.scanSettings","title":"Microsoft Defender scan settings","desc":"Scheduled-scan and scan-behavior preferences: the schedule day and time, the quick-scan time, CPU load factor, and the toggles that disable scanning of archives, email, removable drives, mapped network drives, and network files. Useful for auditing whether periodic scans are scheduled and whether scanning coverage has been narrowed.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"signatureSettings":{"name":"signatureSettings","type":"\u001bwindows.defender.signatureSettings","title":"Microsoft Defender signature and platform update settings","desc":"Definition, engine, and platform update preferences: the update schedule and interval, the catch-up interval, the fallback source order, file-share sources, and the release channels for definitions, engine, and platform. Useful for confirming signatures update frequently enough and from trusted sources.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"status":{"name":"status","type":"\u001bwindows.defender.status","title":"Live engine, signature, and protection status (Get-MpComputerStatus)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"threat":{"name":"threat","type":"\u001bwindows.defender.threat","title":"Microsoft Defender recorded threat","desc":"Single threat recorded in the Defender threat history: its `threatId`, `name`, `severityID`, `categoryID`, whether it `isActive` and whether it executed, and the affected `resources`. Useful for reviewing what Defender has detected on the host over time.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"threatActionSettings":{"name":"threatActionSettings","type":"\u001bwindows.defender.threatActionSettings","title":"Microsoft Defender default threat actions","desc":"Default remediation action applied to threats of each severity (severe, high, moderate, low, and unknown) plus any per-threat-ID action overrides. Audits use this to confirm that severe and high threats are quarantined or removed rather than allowed or left to user choice.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"threatDetection":{"name":"threatDetection","type":"\u001bwindows.defender.threatDetection","title":"Microsoft Defender threat detection","desc":"Single detection event recorded by Defender: the `detectionId`, the associated `threatId`, the `processName` and `domainUser` involved, the detection source and status, the action taken and whether it succeeded, and the detection and remediation timestamps.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"threatDetections":{"name":"threatDetections","type":"\u0019\u001bwindows.defender.threatDetection","title":"Malware detections recorded by Defender","provider":"go.mondoo.com/cnquery/v9/providers/os"},"threatIdAction":{"name":"threatIdAction","type":"\u001bwindows.defender.threatIdAction","title":"Microsoft Defender per-threat-ID action override","desc":"Single override that pins the remediation action for a specific threat ID, pairing the `threatId` with the configured `action`. Overrides let an administrator handle one known threat differently from its severity default.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"threats":{"name":"threats","type":"\u0019\u001bwindows.defender.threat","title":"Threats recorded in the Defender threat history","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender Antivirus","desc":"Complete runtime status and configuration of Microsoft Defender Antivirus, so policies can assert on every Defender security control. The `status` field exposes the live engine, signature, and protection state reported by Get-MpComputerStatus (real-time protection, behavior monitoring, network inspection, tamper protection, scan ages, and signature freshness). The `preferences` field exposes the configurable policy reported by Get-MpPreference, grouped into scan, real-time, cloud-delivered protection, signature-update, threat-action, controlled-folder-access, network-protection, and remediation settings, plus exclusions and Attack Surface Reduction rules. The `threats` and `threatDetections` fields expose the recorded threat history. On systems without Defender (for example servers running a third-party antivirus) these fields resolve to null rather than failing the query.","min_provider_version":"13.29.1","defaults":"enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.asrRule":{"id":"windows.defender.asrRule","name":"windows.defender.asrRule","fields":{"action":{"name":"action","type":"\u0005","is_mandatory":true,"title":"Configured action for the rule","desc":"0 = not configured (disabled), 1 = block, 2 = audit, 5 = not configured, 6 = warn.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Attack Surface Reduction rule GUID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Friendly name of the rule, when the GUID is recognized","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender Attack Surface Reduction rule","desc":"Single Attack Surface Reduction (ASR) rule: its `id` (the rule GUID), the friendly `name` when the GUID is recognized, and the configured `action`. The `id` selects the rule, for example `windows.defender.preferences.attackSurfaceReductionRules.where(id == \"...\")`.","min_provider_version":"13.29.1","defaults":"id name action","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.behavioralNetworkBlockSettings":{"id":"windows.defender.behavioralNetworkBlockSettings","name":"windows.defender.behavioralNetworkBlockSettings","fields":{"bruteForceProtectionAggressiveness":{"name":"bruteForceProtectionAggressiveness","type":"\u0005","is_mandatory":true,"title":"Brute-force protection aggressiveness","desc":"0 = low, 1 = medium, 2 = high.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"bruteForceProtectionConfiguredState":{"name":"bruteForceProtectionConfiguredState","type":"\u0005","is_mandatory":true,"title":"Brute-force protection configured state","desc":"0 = not configured, 1 = block, 2 = audit.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"bruteForceProtectionMaxBlockTime":{"name":"bruteForceProtectionMaxBlockTime","type":"\u0005","is_mandatory":true,"title":"Maximum time (minutes) a brute-force source is blocked","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remoteEncryptionProtectionAggressiveness":{"name":"remoteEncryptionProtectionAggressiveness","type":"\u0005","is_mandatory":true,"title":"Remote-encryption protection aggressiveness","desc":"0 = low, 1 = medium, 2 = high.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remoteEncryptionProtectionConfiguredState":{"name":"remoteEncryptionProtectionConfiguredState","type":"\u0005","is_mandatory":true,"title":"Remote-encryption protection configured state","desc":"0 = not configured, 1 = block, 2 = audit.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remoteEncryptionProtectionMaxBlockTime":{"name":"remoteEncryptionProtectionMaxBlockTime","type":"\u0005","is_mandatory":true,"title":"Maximum time (minutes) a remote-encryption source is blocked","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender behavioral network block settings","desc":"Behavioral network protection preferences that block attacks observed from the network: brute-force protection (against password-guessing attacks) and remote-encryption protection (against remote ransomware encryption). Each exposes its configured state, aggressiveness, and maximum block time.","min_provider_version":"13.29.1","defaults":"bruteForceProtectionConfiguredState remoteEncryptionProtectionConfiguredState","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.cloudSettings":{"id":"windows.defender.cloudSettings","name":"windows.defender.cloudSettings","fields":{"cloudBlockLevel":{"name":"cloudBlockLevel","type":"\u0005","is_mandatory":true,"title":"Cloud-delivered protection block level","desc":"0 = default, 2 = high, 4 = high plus, 6 = zero tolerance.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cloudExtendedTimeout":{"name":"cloudExtendedTimeout","type":"\u0005","is_mandatory":true,"title":"Number of seconds Defender may extend a cloud check (0-50)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableBlockAtFirstSeen":{"name":"disableBlockAtFirstSeen","type":"\u0004","is_mandatory":true,"title":"Whether block-at-first-seen cloud protection is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mapsReporting":{"name":"mapsReporting","type":"\u0005","is_mandatory":true,"title":"MAPS reporting membership level","desc":"0 = disabled, 1 = basic membership, 2 = advanced membership.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"submitSamplesConsent":{"name":"submitSamplesConsent","type":"\u0005","is_mandatory":true,"title":"Sample-submission consent","desc":"0 = always prompt, 1 = send safe samples automatically, 2 = never send, 3 = send all samples automatically.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender cloud-delivered protection settings","desc":"Microsoft Active Protection Service (MAPS) and cloud-delivered protection preferences: the reporting membership level, the sample-submission consent, the cloud block level and extended timeout, and the block-at-first-seen toggle. Together these control how much Defender relies on the cloud for rapid detection of new threats.","min_provider_version":"13.29.1","defaults":"mapsReporting cloudBlockLevel","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.controlledFolderAccess":{"id":"windows.defender.controlledFolderAccess","name":"windows.defender.controlledFolderAccess","fields":{"allowedApplications":{"name":"allowedApplications","type":"\u0019\u0007","is_mandatory":true,"title":"Applications explicitly allowed to write to protected folders","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0005","is_mandatory":true,"title":"Controlled folder access mode","desc":"0 = disabled, 1 = enabled (block), 2 = audit mode, 3 = block disk modification only, 4 = audit disk modification only.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"protectedFolders":{"name":"protectedFolders","type":"\u0019\u0007","is_mandatory":true,"title":"Additional folders protected beyond the system defaults","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender controlled folder access settings","desc":"Controlled-folder-access (ransomware protection) configuration: whether it is enabled or in audit mode, the applications allowed to write to protected folders, and the list of additional protected folders beyond the system defaults.","min_provider_version":"13.29.1","defaults":"enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.exclusions":{"id":"windows.defender.exclusions","name":"windows.defender.exclusions","fields":{"extensions":{"name":"extensions","type":"\u0019\u0007","is_mandatory":true,"title":"Excluded file extensions","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ipAddresses":{"name":"ipAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Excluded IP addresses","provider":"go.mondoo.com/cnquery/v9/providers/os"},"paths":{"name":"paths","type":"\u0019\u0007","is_mandatory":true,"title":"Excluded file and folder paths","provider":"go.mondoo.com/cnquery/v9/providers/os"},"processes":{"name":"processes","type":"\u0019\u0007","is_mandatory":true,"title":"Excluded processes","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender scan exclusions","desc":"Every configured scan exclusion: file and folder `paths`, file `extensions`, `processes`, and `ipAddresses`. Empty lists mean no exclusions of that kind are configured. Exclusions are a common misconfiguration and malware-persistence vector, so audits often verify that these lists are empty or tightly scoped.","min_provider_version":"13.29.1","defaults":"paths extensions processes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.localSettingOverrides":{"id":"windows.defender.localSettingOverrides","name":"windows.defender.localSettingOverrides","fields":{"avgCPULoadFactor":{"name":"avgCPULoadFactor","type":"\u0004","is_mandatory":true,"title":"Whether a local setting may override the scan CPU load factor","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableBehaviorMonitoring":{"name":"disableBehaviorMonitoring","type":"\u0004","is_mandatory":true,"title":"Whether a local setting may override behavior monitoring","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableIOAVProtection":{"name":"disableIOAVProtection","type":"\u0004","is_mandatory":true,"title":"Whether a local setting may override downloaded-file (IOAV) scanning","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableIntrusionPreventionSystem":{"name":"disableIntrusionPreventionSystem","type":"\u0004","is_mandatory":true,"title":"Whether a local setting may override the intrusion prevention system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableOnAccessProtection":{"name":"disableOnAccessProtection","type":"\u0004","is_mandatory":true,"title":"Whether a local setting may override on-access protection","provider":"go.mondoo.com/cnquery/v9/providers/os"},"realtimeMonitoring":{"name":"realtimeMonitoring","type":"\u0004","is_mandatory":true,"title":"Whether a local setting may override real-time monitoring","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scanParameters":{"name":"scanParameters","type":"\u0004","is_mandatory":true,"title":"Whether a local setting may override the default scan type","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scanScheduleDay":{"name":"scanScheduleDay","type":"\u0004","is_mandatory":true,"title":"Whether a local setting may override the scheduled scan day","provider":"go.mondoo.com/cnquery/v9/providers/os"},"spynetReporting":{"name":"spynetReporting","type":"\u0004","is_mandatory":true,"title":"Whether a local setting may override MAPS (SpyNet) reporting","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender local setting overrides","desc":"Whether a locally configured preference is allowed to override the corresponding Group Policy setting. When an override is disabled (false) the policy value is enforced and users cannot change it locally; CIS benchmarks generally require these overrides to be disabled.","min_provider_version":"13.29.1","defaults":"spynetReporting realtimeMonitoring","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.networkProtectionSettings":{"id":"windows.defender.networkProtectionSettings","name":"windows.defender.networkProtectionSettings","fields":{"allowDatagramProcessingOnWinServer":{"name":"allowDatagramProcessingOnWinServer","type":"\u0004","is_mandatory":true,"title":"Whether datagram processing is allowed on Windows Server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowNetworkProtectionDownLevel":{"name":"allowNetworkProtectionDownLevel","type":"\u0004","is_mandatory":true,"title":"Whether network protection is allowed on down-level (older) clients","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowNetworkProtectionOnWinServer":{"name":"allowNetworkProtectionOnWinServer","type":"\u0004","is_mandatory":true,"title":"Whether network protection is allowed on Windows Server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enableDnsSinkhole":{"name":"enableDnsSinkhole","type":"\u0004","is_mandatory":true,"title":"Whether DNS sinkhole enforcement is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enableNetworkProtection":{"name":"enableNetworkProtection","type":"\u0005","is_mandatory":true,"title":"Network protection enforcement mode","desc":"0 = disabled, 1 = enabled (block), 2 = audit mode.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender network protection settings","desc":"Network-protection configuration: the enforcement mode and the toggles that extend protection to Windows Server, down-level clients, and datagram processing, plus DNS sinkhole enforcement. Network protection blocks outbound connections to malicious domains and IP addresses.","min_provider_version":"13.29.1","defaults":"enableNetworkProtection","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.preferences":{"id":"windows.defender.preferences","name":"windows.defender.preferences","fields":{"attackSurfaceReductionRules":{"name":"attackSurfaceReductionRules","type":"\u0019\u001bwindows.defender.asrRule","title":"Configured Attack Surface Reduction (ASR) rules and their actions","provider":"go.mondoo.com/cnquery/v9/providers/os"},"behavioralNetworkBlocks":{"name":"behavioralNetworkBlocks","type":"\u001bwindows.defender.behavioralNetworkBlockSettings","title":"Behavioral network block settings (brute-force and remote-encryption protection)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cloudProtection":{"name":"cloudProtection","type":"\u001bwindows.defender.cloudSettings","title":"Cloud-delivered protection (MAPS) settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"controlledFolderAccess":{"name":"controlledFolderAccess","type":"\u001bwindows.defender.controlledFolderAccess","title":"Controlled folder access (ransomware protection) settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableAutoExclusions":{"name":"disableAutoExclusions","type":"\u0004","title":"Whether automatic exclusions for server roles are disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableGenericReports":{"name":"disableGenericReports","type":"\u0004","title":"Whether sending Watson (generic) reports to Microsoft is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"exclusions":{"name":"exclusions","type":"\u001bwindows.defender.exclusions","title":"Scan exclusions (paths, extensions, processes, IP addresses)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"localSettingOverrides":{"name":"localSettingOverrides","type":"\u001bwindows.defender.localSettingOverrides","title":"Whether a local preference may override the corresponding policy setting","provider":"go.mondoo.com/cnquery/v9/providers/os"},"networkProtection":{"name":"networkProtection","type":"\u001bwindows.defender.networkProtectionSettings","title":"Network protection settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"puaProtection":{"name":"puaProtection","type":"\u0005","title":"Potentially unwanted application (PUA) protection mode","desc":"0 = disabled, 1 = enabled (block), 2 = audit mode.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"randomizeScheduleTaskTimes":{"name":"randomizeScheduleTaskTimes","type":"\u0004","title":"Whether scheduled task start times are randomized","provider":"go.mondoo.com/cnquery/v9/providers/os"},"realTimeProtection":{"name":"realTimeProtection","type":"\u001bwindows.defender.realTimeSettings","title":"Real-time and behavior-monitoring protection settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remediation":{"name":"remediation","type":"\u001bwindows.defender.remediationSettings","title":"Threat remediation settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scan":{"name":"scan","type":"\u001bwindows.defender.scanSettings","title":"Scan schedule and scan-behavior settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signatureUpdates":{"name":"signatureUpdates","type":"\u001bwindows.defender.signatureSettings","title":"Definition, engine, and platform update settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"threatActions":{"name":"threatActions","type":"\u001bwindows.defender.threatActionSettings","title":"Per-severity default threat actions","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uiLockdown":{"name":"uiLockdown","type":"\u0004","title":"Whether the Defender user interface is locked down (hidden from users)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender Antivirus preferences","desc":"Configurable Defender policy reported by Get-MpPreference, grouped so audits can assert on individual controls: `scan` (schedule and scan behavior), `realTimeProtection`, `cloudProtection` (MAPS / cloud-delivered protection), `signatureUpdates`, `threatActions` (per-severity default actions), `controlledFolderAccess`, `networkProtection`, `remediation`, `exclusions`, and `attackSurfaceReductionRules`. This is the intended policy; pair it with windows.defender.status to confirm the policy is actually in effect.","min_provider_version":"13.29.1","defaults":"puaProtection","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.realTimeSettings":{"id":"windows.defender.realTimeSettings","name":"windows.defender.realTimeSettings","fields":{"disableBehaviorMonitoring":{"name":"disableBehaviorMonitoring","type":"\u0004","is_mandatory":true,"title":"Whether behavior monitoring is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableIOAVProtection":{"name":"disableIOAVProtection","type":"\u0004","is_mandatory":true,"title":"Whether scanning of downloaded files and attachments (IOAV) is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableIntrusionPreventionSystem":{"name":"disableIntrusionPreventionSystem","type":"\u0004","is_mandatory":true,"title":"Whether the Network Inspection System (intrusion prevention) is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableRealtimeMonitoring":{"name":"disableRealtimeMonitoring","type":"\u0004","is_mandatory":true,"title":"Whether real-time monitoring is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableScriptScanning":{"name":"disableScriptScanning","type":"\u0004","is_mandatory":true,"title":"Whether script scanning is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enableFileHashComputation":{"name":"enableFileHashComputation","type":"\u0004","is_mandatory":true,"title":"Whether file-hash computation is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"realTimeScanDirection":{"name":"realTimeScanDirection","type":"\u0005","is_mandatory":true,"title":"Direction in which real-time scanning inspects files","desc":"0 = both incoming and outgoing, 1 = incoming only, 2 = outgoing only.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender real-time protection settings","desc":"Real-time protection preferences: the master real-time monitoring toggle, behavior monitoring, downloaded-file (IOAV) scanning, script scanning, on-access protection, the intrusion-prevention system, the scan direction, and file-hash computation. The toggles are phrased as \"disable\" flags, so false generally means the protection is on.","min_provider_version":"13.29.1","defaults":"disableRealtimeMonitoring","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.remediationSettings":{"id":"windows.defender.remediationSettings","name":"windows.defender.remediationSettings","fields":{"disableRestorePoint":{"name":"disableRestorePoint","type":"\u0004","is_mandatory":true,"title":"Whether creation of a system restore point before remediation is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"quarantinePurgeItemsAfterDelay":{"name":"quarantinePurgeItemsAfterDelay","type":"\u0005","is_mandatory":true,"title":"Number of days quarantined items are kept before purging","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remediationScheduleDay":{"name":"remediationScheduleDay","type":"\u0005","is_mandatory":true,"title":"Day of the week scheduled remediation runs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remediationScheduleTime":{"name":"remediationScheduleTime","type":"\u0007","is_mandatory":true,"title":"Time of day scheduled remediation runs (raw schedule value)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender remediation settings","desc":"Threat-remediation preferences: the scheduled remediation day and time, how long quarantined items are retained before purging, and whether system restore points are created before remediation.","min_provider_version":"13.29.1","defaults":"quarantinePurgeItemsAfterDelay","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.scanSettings":{"id":"windows.defender.scanSettings","name":"windows.defender.scanSettings","fields":{"checkForSignaturesBeforeRunningScan":{"name":"checkForSignaturesBeforeRunningScan","type":"\u0005","is_mandatory":true,"title":"Whether to check for new signatures before running a scheduled scan","desc":"0 = never, 1 = before every scan, 2 = disabled.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableArchiveScanning":{"name":"disableArchiveScanning","type":"\u0004","is_mandatory":true,"title":"Whether scanning inside archive files is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableCatchupFullScan":{"name":"disableCatchupFullScan","type":"\u0004","is_mandatory":true,"title":"Whether catch-up full scans are disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableCatchupQuickScan":{"name":"disableCatchupQuickScan","type":"\u0004","is_mandatory":true,"title":"Whether catch-up quick scans are disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableCpuThrottleOnIdleScans":{"name":"disableCpuThrottleOnIdleScans","type":"\u0004","is_mandatory":true,"title":"Whether CPU throttling during idle scans is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableEmailScanning":{"name":"disableEmailScanning","type":"\u0004","is_mandatory":true,"title":"Whether email scanning is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableRemovableDriveScanning":{"name":"disableRemovableDriveScanning","type":"\u0004","is_mandatory":true,"title":"Whether scanning of removable drives during full scans is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableScanningMappedNetworkDrivesForFullScan":{"name":"disableScanningMappedNetworkDrivesForFullScan","type":"\u0004","is_mandatory":true,"title":"Whether scanning of mapped network drives during full scans is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableScanningNetworkFiles":{"name":"disableScanningNetworkFiles","type":"\u0004","is_mandatory":true,"title":"Whether scanning of files on the network is disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enableFullScanOnBatteryPower":{"name":"enableFullScanOnBatteryPower","type":"\u0004","is_mandatory":true,"title":"Whether full scans are allowed to run while on battery power","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enableLowCpuPriority":{"name":"enableLowCpuPriority","type":"\u0004","is_mandatory":true,"title":"Whether scans run at low CPU priority","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scanAvgCPULoadFactor":{"name":"scanAvgCPULoadFactor","type":"\u0005","is_mandatory":true,"title":"Maximum percentage of CPU a scan may consume","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scanOnlyIfIdleEnabled":{"name":"scanOnlyIfIdleEnabled","type":"\u0004","is_mandatory":true,"title":"Whether scheduled scans run only when the computer is idle","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scanParameters":{"name":"scanParameters","type":"\u0005","is_mandatory":true,"title":"Default scan type (1 = quick scan, 2 = full scan)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scanScheduleDay":{"name":"scanScheduleDay","type":"\u0005","is_mandatory":true,"title":"Day of the week a scheduled scan runs","desc":"0 = every day, 1 = Sunday through 7 = Saturday, 8 = never.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scanScheduleOffset":{"name":"scanScheduleOffset","type":"\u0005","is_mandatory":true,"title":"Number of minutes after midnight to offset the scheduled scan","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scanScheduleQuickScanTime":{"name":"scanScheduleQuickScanTime","type":"\u0007","is_mandatory":true,"title":"Time of day a scheduled quick scan runs (raw schedule value)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scanScheduleTime":{"name":"scanScheduleTime","type":"\u0007","is_mandatory":true,"title":"Time of day a scheduled scan runs (raw schedule value)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender scan settings","desc":"Scheduled-scan and scan-behavior preferences: the schedule day and time, the quick-scan time, CPU load factor, and the toggles that disable scanning of archives, email, removable drives, mapped network drives, and network files. Useful for auditing whether periodic scans are scheduled and whether scanning coverage has been narrowed.","min_provider_version":"13.29.1","defaults":"scanParameters scanScheduleDay","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.signatureSettings":{"id":"windows.defender.signatureSettings","name":"windows.defender.signatureSettings","fields":{"definitionUpdatesChannel":{"name":"definitionUpdatesChannel","type":"\u0005","is_mandatory":true,"title":"Release channel for definition updates","provider":"go.mondoo.com/cnquery/v9/providers/os"},"engineUpdatesChannel":{"name":"engineUpdatesChannel","type":"\u0005","is_mandatory":true,"title":"Release channel for engine updates","provider":"go.mondoo.com/cnquery/v9/providers/os"},"meteredConnectionUpdates":{"name":"meteredConnectionUpdates","type":"\u0004","is_mandatory":true,"title":"Whether updates are allowed over metered connections","provider":"go.mondoo.com/cnquery/v9/providers/os"},"platformUpdatesChannel":{"name":"platformUpdatesChannel","type":"\u0005","is_mandatory":true,"title":"Release channel for platform updates","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signatureAuGracePeriod":{"name":"signatureAuGracePeriod","type":"\u0005","is_mandatory":true,"title":"Grace period (minutes) for automatic signature updates","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signatureDefinitionUpdateFileSharesSources":{"name":"signatureDefinitionUpdateFileSharesSources","type":"\u0007","is_mandatory":true,"title":"UNC file-share sources for signature updates","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signatureDisableUpdateOnStartupWithoutEngine":{"name":"signatureDisableUpdateOnStartupWithoutEngine","type":"\u0004","is_mandatory":true,"title":"Whether signature updates on startup without an engine are disabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signatureFallbackOrder":{"name":"signatureFallbackOrder","type":"\u0007","is_mandatory":true,"title":"Ordered list of signature update sources","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signatureFirstAuGracePeriod":{"name":"signatureFirstAuGracePeriod","type":"\u0005","is_mandatory":true,"title":"Grace period (minutes) before the first scheduled update after install","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signatureScheduleDay":{"name":"signatureScheduleDay","type":"\u0005","is_mandatory":true,"title":"Day of the week scheduled signature updates run","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signatureScheduleTime":{"name":"signatureScheduleTime","type":"\u0007","is_mandatory":true,"title":"Time of day scheduled signature updates run (raw schedule value)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signatureUpdateCatchupInterval":{"name":"signatureUpdateCatchupInterval","type":"\u0005","is_mandatory":true,"title":"Hours after which a missed signature update is retried","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signatureUpdateInterval":{"name":"signatureUpdateInterval","type":"\u0005","is_mandatory":true,"title":"Hours between signature update checks","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender signature and platform update settings","desc":"Definition, engine, and platform update preferences: the update schedule and interval, the catch-up interval, the fallback source order, file-share sources, and the release channels for definitions, engine, and platform. Useful for confirming signatures update frequently enough and from trusted sources.","min_provider_version":"13.29.1","defaults":"signatureUpdateInterval","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.status":{"id":"windows.defender.status","name":"windows.defender.status","fields":{"amEngineVersion":{"name":"amEngineVersion","type":"\u0007","is_mandatory":true,"title":"Antimalware engine version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"amProductVersion":{"name":"amProductVersion","type":"\u0007","is_mandatory":true,"title":"Antimalware client (product) version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"amServiceEnabled":{"name":"amServiceEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Windows Defender antimalware service is running","provider":"go.mondoo.com/cnquery/v9/providers/os"},"amServiceVersion":{"name":"amServiceVersion","type":"\u0007","is_mandatory":true,"title":"Antimalware service version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"antispywareEnabled":{"name":"antispywareEnabled","type":"\u0004","is_mandatory":true,"title":"Whether antispyware protection is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"antispywareSignatureAge":{"name":"antispywareSignatureAge","type":"\u0005","is_mandatory":true,"title":"Number of days since antispyware definitions were last updated","provider":"go.mondoo.com/cnquery/v9/providers/os"},"antispywareSignatureLastUpdated":{"name":"antispywareSignatureLastUpdated","type":"\t","is_mandatory":true,"title":"Date the antispyware definitions were last updated","provider":"go.mondoo.com/cnquery/v9/providers/os"},"antispywareSignatureVersion":{"name":"antispywareSignatureVersion","type":"\u0007","is_mandatory":true,"title":"Antispyware definition version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"antivirusEnabled":{"name":"antivirusEnabled","type":"\u0004","is_mandatory":true,"title":"Whether antivirus protection is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"antivirusSignatureAge":{"name":"antivirusSignatureAge","type":"\u0005","is_mandatory":true,"title":"Number of days since antivirus definitions were last updated","provider":"go.mondoo.com/cnquery/v9/providers/os"},"antivirusSignatureLastUpdated":{"name":"antivirusSignatureLastUpdated","type":"\t","is_mandatory":true,"title":"Date the antivirus definitions were last updated","provider":"go.mondoo.com/cnquery/v9/providers/os"},"antivirusSignatureVersion":{"name":"antivirusSignatureVersion","type":"\u0007","is_mandatory":true,"title":"Antivirus definition version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"behaviorMonitorEnabled":{"name":"behaviorMonitorEnabled","type":"\u0004","is_mandatory":true,"title":"Whether behavior monitoring is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"computerID":{"name":"computerID","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the computer as known to Defender","provider":"go.mondoo.com/cnquery/v9/providers/os"},"computerState":{"name":"computerState","type":"\u0005","is_mandatory":true,"title":"Current state of the computer as a bitmask of Defender component states","provider":"go.mondoo.com/cnquery/v9/providers/os"},"defenderSignaturesOutOfDate":{"name":"defenderSignaturesOutOfDate","type":"\u0004","is_mandatory":true,"title":"Whether the Defender signatures are out of date","provider":"go.mondoo.com/cnquery/v9/providers/os"},"deviceControlDefaultEnforcement":{"name":"deviceControlDefaultEnforcement","type":"\u0005","is_mandatory":true,"title":"Default enforcement mode for device control","provider":"go.mondoo.com/cnquery/v9/providers/os"},"deviceControlPoliciesLastUpdated":{"name":"deviceControlPoliciesLastUpdated","type":"\t","is_mandatory":true,"title":"Date the device-control policies were last updated","provider":"go.mondoo.com/cnquery/v9/providers/os"},"deviceControlState":{"name":"deviceControlState","type":"\u0005","is_mandatory":true,"title":"Operational state of device control","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fullScanAge":{"name":"fullScanAge","type":"\u0005","is_mandatory":true,"title":"Number of days since the last full scan completed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fullScanEndTime":{"name":"fullScanEndTime","type":"\t","is_mandatory":true,"title":"Time the last full scan completed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fullScanOverdue":{"name":"fullScanOverdue","type":"\u0004","is_mandatory":true,"title":"Whether a scheduled full scan is overdue","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fullScanRequired":{"name":"fullScanRequired","type":"\u0004","is_mandatory":true,"title":"Whether a full scan is required to complete remediation","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fullScanSignatureVersion":{"name":"fullScanSignatureVersion","type":"\u0007","is_mandatory":true,"title":"Definition version used by the last full scan","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fullScanStartTime":{"name":"fullScanStartTime","type":"\t","is_mandatory":true,"title":"Time the last full scan started","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ioavProtectionEnabled":{"name":"ioavProtectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether scanning of downloaded files and attachments (IOAV) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isTamperProtected":{"name":"isTamperProtected","type":"\u0004","is_mandatory":true,"title":"Whether tamper protection is shielding Defender settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isVirtualMachine":{"name":"isVirtualMachine","type":"\u0004","is_mandatory":true,"title":"Whether the host is a virtual machine","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastFullScanSource":{"name":"lastFullScanSource","type":"\u0005","is_mandatory":true,"title":"Source that triggered the last full scan","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastQuickScanSource":{"name":"lastQuickScanSource","type":"\u0005","is_mandatory":true,"title":"Source that triggered the last quick scan","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nisEnabled":{"name":"nisEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Network Inspection System (NIS) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nisEngineVersion":{"name":"nisEngineVersion","type":"\u0007","is_mandatory":true,"title":"Network Inspection System engine version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nisSignatureAge":{"name":"nisSignatureAge","type":"\u0005","is_mandatory":true,"title":"Number of days since the NIS definitions were last updated","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nisSignatureLastUpdated":{"name":"nisSignatureLastUpdated","type":"\t","is_mandatory":true,"title":"Date the NIS definitions were last updated","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nisSignatureVersion":{"name":"nisSignatureVersion","type":"\u0007","is_mandatory":true,"title":"Network Inspection System definition version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"onAccessProtectionEnabled":{"name":"onAccessProtectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether on-access protection is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"productStatus":{"name":"productStatus","type":"\u0005","is_mandatory":true,"title":"Aggregate product status bitmask","provider":"go.mondoo.com/cnquery/v9/providers/os"},"quickScanAge":{"name":"quickScanAge","type":"\u0005","is_mandatory":true,"title":"Number of days since the last quick scan completed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"quickScanEndTime":{"name":"quickScanEndTime","type":"\t","is_mandatory":true,"title":"Time the last quick scan completed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"quickScanOverdue":{"name":"quickScanOverdue","type":"\u0004","is_mandatory":true,"title":"Whether a scheduled quick scan is overdue","provider":"go.mondoo.com/cnquery/v9/providers/os"},"quickScanSignatureVersion":{"name":"quickScanSignatureVersion","type":"\u0007","is_mandatory":true,"title":"Definition version used by the last quick scan","provider":"go.mondoo.com/cnquery/v9/providers/os"},"quickScanStartTime":{"name":"quickScanStartTime","type":"\t","is_mandatory":true,"title":"Time the last quick scan started","provider":"go.mondoo.com/cnquery/v9/providers/os"},"realTimeProtectionEnabled":{"name":"realTimeProtectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether real-time protection is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"realTimeScanDirection":{"name":"realTimeScanDirection","type":"\u0005","is_mandatory":true,"title":"Direction in which real-time scanning inspects files","desc":"0 = both incoming and outgoing, 1 = incoming only, 2 = outgoing only.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rebootRequired":{"name":"rebootRequired","type":"\u0004","is_mandatory":true,"title":"Whether a reboot is required to finish remediation","provider":"go.mondoo.com/cnquery/v9/providers/os"},"smartAppControlExpiration":{"name":"smartAppControlExpiration","type":"\t","is_mandatory":true,"title":"Expiration time of the Smart App Control evaluation period","provider":"go.mondoo.com/cnquery/v9/providers/os"},"smartAppControlState":{"name":"smartAppControlState","type":"\u0007","is_mandatory":true,"title":"State of Smart App Control","desc":"One of On, Off, Eval, or an empty string when unsupported.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tamperProtectionSource":{"name":"tamperProtectionSource","type":"\u0007","is_mandatory":true,"title":"Source that manages tamper protection (for example Intune, signatures, or the local UI)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender Antivirus runtime status","desc":"Live state reported by Get-MpComputerStatus: whether the antimalware service and each protection component (real-time, behavior monitoring, IOAV, on-access, network inspection) are enabled, the engine and signature versions and their ages, the most recent quick and full scan times and whether they are overdue, tamper-protection state and source, and whether a reboot or signature update is pending. This is the \"is Defender actually protecting the host right now\" view, complementing the policy in windows.defender.preferences.","min_provider_version":"13.29.1","defaults":"antivirusEnabled realTimeProtectionEnabled isTamperProtected","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.threat":{"id":"windows.defender.threat","name":"windows.defender.threat","fields":{"categoryID":{"name":"categoryID","type":"\u0005","is_mandatory":true,"title":"Category identifier of the threat","provider":"go.mondoo.com/cnquery/v9/providers/os"},"didThreatExecute":{"name":"didThreatExecute","type":"\u0004","is_mandatory":true,"title":"Whether the threat executed on the system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"isActive":{"name":"isActive","type":"\u0004","is_mandatory":true,"title":"Whether the threat is currently active","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Threat name as reported by Defender","provider":"go.mondoo.com/cnquery/v9/providers/os"},"resources":{"name":"resources","type":"\u0019\u0007","is_mandatory":true,"title":"Resources (files, registry keys, processes) affected by the threat","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rollupStatus":{"name":"rollupStatus","type":"\u0005","is_mandatory":true,"title":"Aggregate rollup status of the threat","provider":"go.mondoo.com/cnquery/v9/providers/os"},"severityID":{"name":"severityID","type":"\u0005","is_mandatory":true,"title":"Severity identifier (higher is more severe)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"threatId":{"name":"threatId","type":"\u0005","is_mandatory":true,"title":"Numeric threat identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender recorded threat","desc":"Single threat recorded in the Defender threat history: its `threatId`, `name`, `severityID`, `categoryID`, whether it `isActive` and whether it executed, and the affected `resources`. Useful for reviewing what Defender has detected on the host over time.","min_provider_version":"13.29.1","defaults":"name severityID isActive","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.threatActionSettings":{"id":"windows.defender.threatActionSettings","name":"windows.defender.threatActionSettings","fields":{"highThreatDefaultAction":{"name":"highThreatDefaultAction","type":"\u0005","is_mandatory":true,"title":"Default action for high-severity threats (see severeThreatDefaultAction for values)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"idActions":{"name":"idActions","type":"\u0019\u001bwindows.defender.threatIdAction","title":"Per-threat-ID default action overrides","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lowThreatDefaultAction":{"name":"lowThreatDefaultAction","type":"\u0005","is_mandatory":true,"title":"Default action for low-severity threats (see severeThreatDefaultAction for values)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"moderateThreatDefaultAction":{"name":"moderateThreatDefaultAction","type":"\u0005","is_mandatory":true,"title":"Default action for moderate-severity threats (see severeThreatDefaultAction for values)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"severeThreatDefaultAction":{"name":"severeThreatDefaultAction","type":"\u0005","is_mandatory":true,"title":"Default action for severe-severity threats","desc":"1 = clean, 2 = quarantine, 3 = remove, 6 = allow, 8 = user defined, 9 = no action, 10 = block.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"unknownThreatDefaultAction":{"name":"unknownThreatDefaultAction","type":"\u0005","is_mandatory":true,"title":"Default action for unknown-severity threats (see severeThreatDefaultAction for values)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender default threat actions","desc":"Default remediation action applied to threats of each severity (severe, high, moderate, low, and unknown) plus any per-threat-ID action overrides. Audits use this to confirm that severe and high threats are quarantined or removed rather than allowed or left to user choice.","min_provider_version":"13.29.1","defaults":"severeThreatDefaultAction highThreatDefaultAction","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.threatDetection":{"id":"windows.defender.threatDetection","name":"windows.defender.threatDetection","fields":{"actionSuccess":{"name":"actionSuccess","type":"\u0004","is_mandatory":true,"title":"Whether the remediation action succeeded","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cleaningActionID":{"name":"cleaningActionID","type":"\u0005","is_mandatory":true,"title":"Identifier of the cleaning action applied","provider":"go.mondoo.com/cnquery/v9/providers/os"},"currentThreatExecutionStatusID":{"name":"currentThreatExecutionStatusID","type":"\u0005","is_mandatory":true,"title":"Current execution status of the detected threat","provider":"go.mondoo.com/cnquery/v9/providers/os"},"detectionId":{"name":"detectionId","type":"\u0007","is_mandatory":true,"title":"Unique detection identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"detectionSourceTypeId":{"name":"detectionSourceTypeId","type":"\u0005","is_mandatory":true,"title":"Detection source type identifier","provider":"go.mondoo.com/cnquery/v9/providers/os"},"domainUser":{"name":"domainUser","type":"\u0007","is_mandatory":true,"title":"Domain user in whose context the detection occurred","provider":"go.mondoo.com/cnquery/v9/providers/os"},"initialDetectionTime":{"name":"initialDetectionTime","type":"\t","is_mandatory":true,"title":"Time the threat was first detected","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastThreatStatusChangeTime":{"name":"lastThreatStatusChangeTime","type":"\t","is_mandatory":true,"title":"Time the threat status last changed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"processName":{"name":"processName","type":"\u0007","is_mandatory":true,"title":"Name of the process involved in the detection","provider":"go.mondoo.com/cnquery/v9/providers/os"},"remediationTime":{"name":"remediationTime","type":"\t","is_mandatory":true,"title":"Time remediation completed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"resources":{"name":"resources","type":"\u0019\u0007","is_mandatory":true,"title":"Resources (files, registry keys, processes) affected by the detection","provider":"go.mondoo.com/cnquery/v9/providers/os"},"threatId":{"name":"threatId","type":"\u0005","is_mandatory":true,"title":"Numeric threat identifier associated with the detection","provider":"go.mondoo.com/cnquery/v9/providers/os"},"threatStatusID":{"name":"threatStatusID","type":"\u0005","is_mandatory":true,"title":"Status identifier of the threat","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender threat detection","desc":"Single detection event recorded by Defender: the `detectionId`, the associated `threatId`, the `processName` and `domainUser` involved, the detection source and status, the action taken and whether it succeeded, and the detection and remediation timestamps.","min_provider_version":"13.29.1","defaults":"threatId processName actionSuccess","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.defender.threatIdAction":{"id":"windows.defender.threatIdAction","name":"windows.defender.threatIdAction","fields":{"action":{"name":"action","type":"\u0005","is_mandatory":true,"title":"Action applied to the threat","desc":"1 = clean, 2 = quarantine, 3 = remove, 6 = allow, 8 = user defined, 9 = no action, 10 = block.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"threatId":{"name":"threatId","type":"\u0007","is_mandatory":true,"title":"Threat ID the override applies to","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender per-threat-ID action override","desc":"Single override that pins the remediation action for a specific threat ID, pairing the `threatId` with the configured `action`. Overrides let an administrator handle one known threat differently from its severity default.","min_provider_version":"13.29.1","defaults":"threatId action","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.deviceGuard":{"id":"windows.deviceGuard","name":"windows.deviceGuard","fields":{"credentialGuardConfig":{"name":"credentialGuardConfig","type":"\u0005","is_mandatory":true,"title":"Credential Guard configuration (LsaCfgFlags)","desc":"0=off, 1=enabled with UEFI lock, 2=enabled without lock. Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hvciMatRequired":{"name":"hvciMatRequired","type":"\u0004","is_mandatory":true,"title":"Whether HVCI requires a Memory Access Table (HVCIMATRequired)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hypervisorEnforcedCodeIntegrity":{"name":"hypervisorEnforcedCodeIntegrity","type":"\u0005","is_mandatory":true,"title":"Hypervisor-Enforced Code Integrity / Memory Integrity (HypervisorEnforcedCodeIntegrity)","desc":"0=disabled, 1=enabled with UEFI lock, 2=enabled without lock. Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"kernelShadowStacksLaunch":{"name":"kernelShadowStacksLaunch","type":"\u0005","is_mandatory":true,"title":"Kernel-mode hardware-enforced stack protection (ConfigureKernelShadowStacksLaunch)","desc":"1=enabled in enforcement mode, 2=enabled in audit mode, 0=disabled. Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"requirePlatformSecurityFeatures":{"name":"requirePlatformSecurityFeatures","type":"\u0005","is_mandatory":true,"title":"Required platform security features for VBS (RequirePlatformSecurityFeatures)","desc":"1=Secure Boot, 3=Secure Boot and DMA Protection. Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"systemGuardLaunch":{"name":"systemGuardLaunch","type":"\u0004","is_mandatory":true,"title":"Whether System Guard Secure Launch is enabled (ConfigureSystemGuardLaunch)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"virtualizationBasedSecurityEnabled":{"name":"virtualizationBasedSecurityEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Virtualization-Based Security is enabled (EnableVirtualizationBasedSecurity)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Device Guard policy (Virtualization-Based Security, HVCI, and Credential Guard)","desc":"Device Guard Group Policy values under HKLM\\SOFTWARE\\Policies \\Microsoft\\Windows\\DeviceGuard. These configure Virtualization-Based Security (VBS), Hypervisor-Enforced Code Integrity (HVCI / Memory Integrity), Credential Guard, System Guard Secure Launch, and kernel-mode hardware-enforced stack protection. On/off settings are exposed as booleans and graded settings (such as the HVCI and Credential Guard lock modes) as integers. Every field reads null when the underlying value is absent, so \"not configured\" is distinguishable from an explicit false or 0. Read from the Windows registry, so it is available even on connections that cannot run commands.","private":true,"min_provider_version":"13.29.1","defaults":"virtualizationBasedSecurityEnabled hypervisorEnforcedCodeIntegrity credentialGuardConfig","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.eventlog":{"id":"windows.eventlog","name":"windows.eventlog","fields":{"maxSizeKB":{"name":"maxSizeKB","type":"\u0005","title":"Maximum log file size in KB (MaxSize)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Event Log channel name (for example Application, Security, Setup, or System)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"overwriteAsNeeded":{"name":"overwriteAsNeeded","type":"\u0004","title":"Whether the channel overwrites events as needed when full (Retention 0)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"retention":{"name":"retention","type":"\u0007","title":"Retention behavior when the log reaches its maximum size","desc":"One of \"overwrite_as_needed\" (Retention 0), \"overwrite_by_days\" (a positive retention period in seconds), or \"never_overwrite\" (Retention 4294967295 or -1).","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Windows Event Log channel configuration","desc":"Size and retention policy of a single Windows Event Log channel. The `name` field selects the channel as it appears under the EventLog registry tree, for example `windows.eventlog(name: \"Security\")` or `windows.eventlog(name: \"Application\")`. `maxSizeKB` reports the maximum log file size in KB and `retention` decodes how the channel behaves when that size is reached. Each field resolves the Group Policy value first, then the effective channel configuration, and finally the documented Windows default when neither is set.","min_provider_version":"13.22.2","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.exploitProtection":{"id":"windows.exploitProtection","name":"windows.exploitProtection","fields":{"aslr":{"name":"aslr","type":"\u001bwindows.exploitProtection.aslr","title":"Address space layout randomization (ASLR) settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"available":{"name":"available","type":"\u0004","title":"Whether the Get-ProcessMitigation cmdlet is available on the target","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cfg":{"name":"cfg","type":"\u001bwindows.exploitProtection.cfg","title":"Windows Exploit Protection: Control Flow Guard (CFG)","desc":"CFG protects against memory-corruption exploits that hijack indirect calls. Each value is \"ON\", \"OFF\", or \"NOTSET\". Reached through `windows.exploitProtection.controlFlowGuard`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"controlFlowGuard":{"name":"controlFlowGuard","type":"\u001bwindows.exploitProtection.cfg","title":"Control Flow Guard (CFG) settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dep":{"name":"dep","type":"\u001bwindows.exploitProtection.dep","title":"Data execution prevention (DEP) settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disallowOverride":{"name":"disallowOverride","type":"\u0004","title":"Whether users are prevented from overriding the exploit protection settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"heap":{"name":"heap","type":"\u001bwindows.exploitProtection.heap","title":"Heap integrity settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sehop":{"name":"sehop","type":"\u001bwindows.exploitProtection.sehop","title":"Structured Exception Handling Overwrite Protection (SEHOP) settings","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Exploit Protection","desc":"System-wide Windows Exploit Protection (the successor to EMET) configuration, reported by `Get-ProcessMitigation -System`. Five mitigations are supported system-wide: data execution prevention (`dep`), address space layout randomization (`aslr`), Control Flow Guard (`controlFlowGuard`), structured exception handling overwrite protection (`sehop`), and heap integrity (`heap`). `disallowOverride` reflects whether users may override these settings. On systems without the ProcessMitigations module the mitigation accessors resolve to null while `disallowOverride` still resolves from the registry.","min_provider_version":"13.29.1","defaults":"disallowOverride","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.exploitProtection.aslr":{"id":"windows.exploitProtection.aslr","name":"windows.exploitProtection.aslr","fields":{"bottomUp":{"name":"bottomUp","type":"\u0007","is_mandatory":true,"title":"Whether bottom-up randomization is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"forceRelocateImages":{"name":"forceRelocateImages","type":"\u0007","is_mandatory":true,"title":"Whether images without /DYNAMICBASE are forcibly relocated","provider":"go.mondoo.com/cnquery/v9/providers/os"},"highEntropy":{"name":"highEntropy","type":"\u0007","is_mandatory":true,"title":"Whether high-entropy bottom-up randomization is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"requireInfo":{"name":"requireInfo","type":"\u0007","is_mandatory":true,"title":"Whether images are required to declare ASLR support","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Exploit Protection: address space layout randomization (ASLR)","desc":"ASLR randomizes the memory layout of a process to frustrate exploits that rely on predictable addresses. Each value is \"ON\", \"OFF\", or \"NOTSET\". Reached through `windows.exploitProtection.aslr`.","private":true,"min_provider_version":"13.29.1","defaults":"bottomUp forceRelocateImages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.exploitProtection.cfg":{"id":"windows.exploitProtection.cfg","name":"windows.exploitProtection.cfg","fields":{"enable":{"name":"enable","type":"\u0007","is_mandatory":true,"title":"Whether Control Flow Guard is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"strictControlFlowGuard":{"name":"strictControlFlowGuard","type":"\u0007","is_mandatory":true,"title":"Whether strict Control Flow Guard is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"suppressExports":{"name":"suppressExports","type":"\u0007","is_mandatory":true,"title":"Whether export suppression is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Exploit Protection: Control Flow Guard (CFG)","desc":"CFG protects against memory-corruption exploits that hijack indirect calls. Each value is \"ON\", \"OFF\", or \"NOTSET\". Reached through `windows.exploitProtection.controlFlowGuard`.","private":true,"min_provider_version":"13.29.1","defaults":"enable","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.exploitProtection.dep":{"id":"windows.exploitProtection.dep","name":"windows.exploitProtection.dep","fields":{"emulateAtlThunks":{"name":"emulateAtlThunks","type":"\u0007","is_mandatory":true,"title":"Whether ATL thunk emulation is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enable":{"name":"enable","type":"\u0007","is_mandatory":true,"title":"Whether DEP is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Exploit Protection: data execution prevention (DEP)","desc":"DEP prevents memory not explicitly marked executable from running as code. Each value is \"ON\", \"OFF\", or \"NOTSET\". Reached through `windows.exploitProtection.dep`.","private":true,"min_provider_version":"13.29.1","defaults":"enable","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.exploitProtection.heap":{"id":"windows.exploitProtection.heap","name":"windows.exploitProtection.heap","fields":{"terminateOnError":{"name":"terminateOnError","type":"\u0007","is_mandatory":true,"title":"Whether the process is terminated on heap corruption","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Exploit Protection: heap integrity","desc":"Terminating on heap corruption prevents an attacker from continuing execution after corrupting the heap. The value is \"ON\", \"OFF\", or \"NOTSET\". Reached through `windows.exploitProtection.heap`.","private":true,"min_provider_version":"13.29.1","defaults":"terminateOnError","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.exploitProtection.sehop":{"id":"windows.exploitProtection.sehop","name":"windows.exploitProtection.sehop","fields":{"enable":{"name":"enable","type":"\u0007","is_mandatory":true,"title":"Whether SEHOP is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"telemetryOnly":{"name":"telemetryOnly","type":"\u0007","is_mandatory":true,"title":"Whether SEHOP runs in telemetry-only mode","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Exploit Protection: structured exception handling overwrite protection (SEHOP)","desc":"SEHOP blocks exploits that overwrite the structured exception handler chain. Each value is \"ON\", \"OFF\", or \"NOTSET\". Reached through `windows.exploitProtection.sehop`.","private":true,"min_provider_version":"13.29.1","defaults":"enable","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.firewall":{"id":"windows.firewall","name":"windows.firewall","fields":{"profile":{"name":"profile","type":"\u001bwindows.firewall.profile","title":"Windows Firewall profile entry","desc":"Per-profile firewall settings for one of the three Windows Firewall profiles (Domain, Private, Public): whether the firewall is enabled, default inbound and outbound actions, local rule merge policies, unicast response behavior, stealth mode for IPsec, and log settings including max log size, allowed/blocked packet logging, and log file name.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"profiles":{"name":"profiles","type":"\u0019\u001bwindows.firewall.profile","title":"Settings that apply to the per-profile configurations of the Windows Firewall with Advanced Security","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rule":{"name":"rule","type":"\u001bwindows.firewall.rule","title":"Windows Firewall rule entry","desc":"Single Windows Firewall rule: its unique `instanceID`, display name, description, group, enabled state, traffic direction (inbound/ outbound), action (allow/block), edge traversal policy, and enforcement status. Iterated from `windows.firewall.rules` to audit which rules are active and whether they match expected policy.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bwindows.firewall.rule","title":"Firewall rules","provider":"go.mondoo.com/cnquery/v9/providers/os"},"settings":{"name":"settings","type":"\n","title":"Global firewall settings (Get-NetFirewallSetting), as a dictionary of setting name to value","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Firewall (Advanced Security)","desc":"Windows Firewall with Advanced Security posture: the global settings, the per-profile defaults (Domain, Private, Public), and every configured firewall rule. Use `profiles` to assert that the firewall is enabled and blocks inbound traffic by default on each profile, and `rules` to audit which allow/block rules are active. Backed by the `Get-NetFirewallProfile` and `Get-NetFirewallRule` PowerShell cmdlets.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.firewall.profile":{"id":"windows.firewall.profile","name":"windows.firewall.profile","fields":{"allowInboundRules":{"name":"allowInboundRules","type":"\u0005","is_mandatory":true,"title":"Whether administrators can create firewall rules that allow unsolicited inbound traffic (if 0, such rules are ignored)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowLocalFirewallRules":{"name":"allowLocalFirewallRules","type":"\u0005","is_mandatory":true,"title":"Whether local firewall rules should merge into the effective policy along with group policy settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowLocalIPsecRules":{"name":"allowLocalIPsecRules","type":"\u0005","is_mandatory":true,"title":"Whether local IPsec rules should merge into the effective policy along with rules from group policy","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowUnicastResponseToMulticast":{"name":"allowUnicastResponseToMulticast","type":"\u0005","is_mandatory":true,"title":"Whether to allow unicast responses to multicast traffic","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowUserApps":{"name":"allowUserApps","type":"\u0005","is_mandatory":true,"title":"Whether to respect user allowed applications created in the legacy firewall","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowUserPorts":{"name":"allowUserPorts","type":"\u0005","is_mandatory":true,"title":"Whether to respect globally opened ports created in the legacy firewall","provider":"go.mondoo.com/cnquery/v9/providers/os"},"defaultInboundAction":{"name":"defaultInboundAction","type":"\u0005","is_mandatory":true,"title":"Default action for inbound traffic (2 = allow, 4 = block)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"defaultOutboundAction":{"name":"defaultOutboundAction","type":"\u0005","is_mandatory":true,"title":"Default action for outbound traffic (2 = allow, 4 = block)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enableStealthModeForIPsec":{"name":"enableStealthModeForIPsec","type":"\u0005","is_mandatory":true,"title":"Whether to use stealth mode for IPsec-protected traffic","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0005","is_mandatory":true,"title":"Whether the firewall is enabled on this profile (1 = enabled, 0 = disabled)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"instanceID":{"name":"instanceID","type":"\u0007","is_mandatory":true,"provider":"go.mondoo.com/cnquery/v9/providers/os"},"logAllowed":{"name":"logAllowed","type":"\u0005","is_mandatory":true,"title":"Whether to log allowed packets","provider":"go.mondoo.com/cnquery/v9/providers/os"},"logBlocked":{"name":"logBlocked","type":"\u0005","is_mandatory":true,"title":"Whether to log blocked traffic","provider":"go.mondoo.com/cnquery/v9/providers/os"},"logFileName":{"name":"logFileName","type":"\u0007","is_mandatory":true,"title":"Filename in which to store the firewall log","provider":"go.mondoo.com/cnquery/v9/providers/os"},"logIgnored":{"name":"logIgnored","type":"\u0005","is_mandatory":true,"title":"Whether to log an event when rules are ignored","provider":"go.mondoo.com/cnquery/v9/providers/os"},"logMaxSizeKilobytes":{"name":"logMaxSizeKilobytes","type":"\u0005","is_mandatory":true,"title":"Maximum size the log file can reach before being rotated, in kilobytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the profile (Domain, Private, or Public)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"notifyOnListen":{"name":"notifyOnListen","type":"\u0005","is_mandatory":true,"title":"Whether to notify users when an application listens on a port that is closed","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Firewall profile entry","desc":"Per-profile firewall settings for one of the three Windows Firewall profiles (Domain, Private, Public): whether the firewall is enabled, default inbound and outbound actions, local rule merge policies, unicast response behavior, stealth mode for IPsec, and log settings including max log size, allowed/blocked packet logging, and log file name.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.firewall.rule":{"id":"windows.firewall.rule","name":"windows.firewall.rule","fields":{"action":{"name":"action","type":"\u0005","is_mandatory":true,"title":"Specifies the action to take on traffic that matches this rule","desc":"Values: block, allow, or allow only if secure (reported as the integer action code returned by Get-NetFirewallRule).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Brief description of the rule","provider":"go.mondoo.com/cnquery/v9/providers/os"},"direction":{"name":"direction","type":"\u0005","is_mandatory":true,"title":"Specifies which direction of traffic to match with this rule","desc":"Values: inbound (1), outbound (2).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"displayGroup":{"name":"displayGroup","type":"\u0007","is_mandatory":true,"title":"The group that this rule belongs to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Localized name of this rule","provider":"go.mondoo.com/cnquery/v9/providers/os"},"edgeTraversalPolicy":{"name":"edgeTraversalPolicy","type":"\u0005","is_mandatory":true,"title":"Specifies how this firewall rule will handle edge traversal cases","desc":"Values: block (0), allow (1), defer to user (2), defer to app (3).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0005","is_mandatory":true,"title":"Whether this rule is administratively enabled or disabled","desc":"Values: enabled (1), disabled (2).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enforcementStatus":{"name":"enforcementStatus","type":"\u0007","is_mandatory":true,"title":"Whether this object is retrieved from the ActiveStore","provider":"go.mondoo.com/cnquery/v9/providers/os"},"instanceID":{"name":"instanceID","type":"\u0007","is_mandatory":true,"title":"A string that uniquely identifies this instance within the policy store","provider":"go.mondoo.com/cnquery/v9/providers/os"},"localOnlyMapping":{"name":"localOnlyMapping","type":"\u0004","is_mandatory":true,"title":"Whether to group UDP packets into conversations based only on the local address and port","provider":"go.mondoo.com/cnquery/v9/providers/os"},"looseSourceMapping":{"name":"looseSourceMapping","type":"\u0004","is_mandatory":true,"title":"Whether to group UDP packets into conversations based on the local address, local port, and remote port","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the rule","provider":"go.mondoo.com/cnquery/v9/providers/os"},"policyStoreSource":{"name":"policyStoreSource","type":"\u0007","is_mandatory":true,"title":"Contains the path to the policy store where this rule originally came from","provider":"go.mondoo.com/cnquery/v9/providers/os"},"policyStoreSourceType":{"name":"policyStoreSourceType","type":"\u0005","is_mandatory":true,"title":"Describes the type of policy store where this rule originally came from","provider":"go.mondoo.com/cnquery/v9/providers/os"},"primaryStatus":{"name":"primaryStatus","type":"\u0005","is_mandatory":true,"title":"PrimaryStatus provides a high level status value","desc":"Values: unknown (0), OK (1), degraded (2), error (3).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Detailed status of the rule","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Firewall rule entry","desc":"Single Windows Firewall rule: its unique `instanceID`, display name, description, group, enabled state, traffic direction (inbound/ outbound), action (allow/block), edge traversal policy, and enforcement status. Iterated from `windows.firewall.rules` to audit which rules are active and whether they match expected policy.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.hotfix":{"id":"windows.hotfix","name":"windows.hotfix","fields":{"caption":{"name":"caption","type":"\u0007","is_mandatory":true,"title":"Reference to knowledge base","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Type of hotfix (e.g., Update or Security Update)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hotfixId":{"name":"hotfixId","type":"\u0007","is_mandatory":true,"title":"Hotfix ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installedBy":{"name":"installedBy","type":"\u0007","is_mandatory":true,"title":"User that installed the hotfix","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installedOn":{"name":"installedOn","type":"\t","is_mandatory":true,"title":"Date when the hotfix was installed","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"hotfixId","type":"\u0007"}]},"title":"Windows hotfix","desc":"Single installed Windows hotfix (a Quick Fix Engineering update): its `hotfixId` (for example \"KB5034441\"), the `description` type of the fix, the knowledge-base `caption` URL, the `installedOn` date, and the account that installed it. Audit patch compliance across `windows.hotfixes`, for example `windows.hotfixes.where(installedOn \u003e time.now - 30*time.day)`.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.lsa":{"id":"windows.lsa","name":"windows.lsa","fields":{"disableDomainCreds":{"name":"disableDomainCreds","type":"\u0004","title":"Whether storing network authentication credentials is disabled (Lsa\\DisableDomainCreds)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"everyoneIncludesAnonymous":{"name":"everyoneIncludesAnonymous","type":"\u0004","title":"Whether the Everyone permissions apply to anonymous users (Lsa\\EveryoneIncludesAnonymous)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"forceGuest":{"name":"forceGuest","type":"\u0004","title":"Whether the guest-only sharing and security model is used for local accounts (Lsa\\ForceGuest)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"limitBlankPasswordUse":{"name":"limitBlankPasswordUse","type":"\u0004","title":"Whether local accounts with blank passwords are limited to console logon (Lsa\\LimitBlankPasswordUse)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lmCompatibilityLevel":{"name":"lmCompatibilityLevel","type":"\u0005","title":"LAN Manager authentication level (Lsa\\LmCompatibilityLevel; 0-5, higher is stronger)","desc":"0 sends LM and NTLM responses; 5 sends NTLMv2 only and refuses LM and NTLM. Higher values are more secure; CIS baselines require 5.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"noLmHash":{"name":"noLmHash","type":"\u0004","title":"Whether the LAN Manager (LM) hash of new passwords is not stored (Lsa\\NoLMHash)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ntlm":{"name":"ntlm","type":"\u001bwindows.lsa.ntlm","title":"NTLM authentication settings (Lsa\\MSV1_0 and the WDigest provider)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"restrictAnonymous":{"name":"restrictAnonymous","type":"\u0005","title":"Restrictions on anonymous (null session) connections (Lsa\\RestrictAnonymous; higher is more restrictive)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"restrictAnonymousSam":{"name":"restrictAnonymousSam","type":"\u0004","title":"Whether anonymous enumeration of SAM accounts is disallowed (Lsa\\RestrictAnonymousSAM)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"restrictRemoteSam":{"name":"restrictRemoteSam","type":"\u0007","title":"SDDL string controlling which clients may make remote SAM calls (Lsa\\restrictremotesam, REG_SZ)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runAsPpl":{"name":"runAsPpl","type":"\u0005","title":"LSA protection / Run as Protected Process Light level (Lsa\\RunAsPPL; 1 or 2 enables LSA protection)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sceNoApplyLegacyAuditPolicy":{"name":"sceNoApplyLegacyAuditPolicy","type":"\u0004","title":"Whether advanced audit policy is forced over legacy audit categories (Lsa\\SCENoApplyLegacyAuditPolicy)","desc":"When set, the advanced audit policy subcategories are forced and the legacy audit categories are ignored.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"secureChannel":{"name":"secureChannel","type":"\u001bwindows.lsa.secureChannel","title":"Netlogon secure-channel settings (Services\\Netlogon\\Parameters)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"submitControl":{"name":"submitControl","type":"\u0004","title":"Whether recovery console authority delegation submit-control is allowed (Lsa\\SubmitControl)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"useMachineId":{"name":"useMachineId","type":"\u0004","title":"Whether the computer account identity is used for outbound authentication (Lsa\\UseMachineId)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Local Security Authority (LSA) security policy","desc":"Local Security Authority configuration that backs the \"Network access\", \"Network security\", and related security options under HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa. These values control anonymous access restrictions, blank-password use, LAN Manager authentication level, NTLM hashing, LSA protection (RunAsPPL), and audit behavior. On/off settings are exposed as booleans and graded settings (such as the LAN Manager authentication level) as integers. NTLM (MSV1_0 and WDigest) settings are grouped under `ntlm` and the Netlogon secure-channel settings under `secureChannel`. Values are nullable: an absent value resolves to null so it is distinguishable from an explicit false or 0, letting checks assert on configured-vs-default precisely.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.lsa.ntlm":{"id":"windows.lsa.ntlm","name":"windows.lsa.ntlm","fields":{"allowNullSessionFallback":{"name":"allowNullSessionFallback","type":"\u0004","is_mandatory":true,"title":"Whether NTLM NULL session fallback is allowed (MSV1_0\\AllowNullSessionFallback)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowOnlineId":{"name":"allowOnlineId","type":"\u0004","is_mandatory":true,"title":"Whether online identities (PKU2U) may authenticate to this computer (Lsa\\pku2u\\AllowOnlineID)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditReceivingNtlmTraffic":{"name":"auditReceivingNtlmTraffic","type":"\u0005","is_mandatory":true,"title":"Audit level for incoming NTLM traffic (MSV1_0\\AuditReceivingNTLMTraffic; 0 off, 1 allow, 2 deny-all)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ntlmMinClientSec":{"name":"ntlmMinClientSec","type":"\u0005","is_mandatory":true,"title":"Minimum session security negotiated for NTLM SSP clients (MSV1_0\\NTLMMinClientSec, bitmask)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ntlmMinServerSec":{"name":"ntlmMinServerSec","type":"\u0005","is_mandatory":true,"title":"Minimum session security negotiated for NTLM SSP servers (MSV1_0\\NTLMMinServerSec, bitmask)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"restrictSendingNtlmTraffic":{"name":"restrictSendingNtlmTraffic","type":"\u0005","is_mandatory":true,"title":"Restriction level for outgoing NTLM traffic to remote servers (MSV1_0\\RestrictSendingNTLMTraffic; 0 allow, 1 audit, 2 deny-all)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"useLogonCredential":{"name":"useLogonCredential","type":"\u0004","is_mandatory":true,"title":"Whether WDigest caches plaintext credentials in memory (WDigest\\UseLogonCredential)","desc":"When enabled, WDigest keeps clear-text passwords in LSASS memory where credential-theft tools can read them. The hardened state is false (0).","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows LSA NTLM authentication settings","desc":"NTLM security settings under HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0 together with the WDigest provider's UseLogonCredential value under HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest. These control NULL session fallback, inbound/outbound NTLM auditing and restriction, the minimum negotiated NTLM session security for clients and servers, and whether WDigest caches plaintext credentials in memory. On/off settings are exposed as booleans and graded settings (audit and restriction levels, the minimum-session-security bitmasks) as integers. Values are nullable so an absent value is distinguishable from an explicit false or 0.","private":true,"min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.lsa.secureChannel":{"id":"windows.lsa.secureChannel","name":"windows.lsa.secureChannel","fields":{"auditNtlmInDomain":{"name":"auditNtlmInDomain","type":"\u0005","is_mandatory":true,"title":"Audit level for inbound NTLM traffic on domain controllers (Netlogon\\Parameters\\AuditNTLMInDomain, bitmask)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"blockNetbiosDiscovery":{"name":"blockNetbiosDiscovery","type":"\u0004","is_mandatory":true,"title":"Whether NetBIOS-based domain controller discovery is blocked (Policies\\Microsoft\\Netlogon\\Parameters\\BlockNetbiosDiscovery)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disablePasswordChange":{"name":"disablePasswordChange","type":"\u0004","is_mandatory":true,"title":"Whether automatic machine account password changes are disabled (Netlogon\\Parameters\\DisablePasswordChange)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"maximumPasswordAge":{"name":"maximumPasswordAge","type":"\u0005","is_mandatory":true,"title":"Maximum machine account password age in days (Netlogon\\Parameters\\MaximumPasswordAge)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"refusePasswordChange":{"name":"refusePasswordChange","type":"\u0004","is_mandatory":true,"title":"Whether the domain controller refuses machine account password changes (Netlogon\\Parameters\\RefusePasswordChange)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"requireSignOrSeal":{"name":"requireSignOrSeal","type":"\u0004","is_mandatory":true,"title":"Whether secure-channel data is digitally signed or sealed when possible (Netlogon\\Parameters\\RequireSignOrSeal)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"requireStrongKey":{"name":"requireStrongKey","type":"\u0004","is_mandatory":true,"title":"Whether a strong (128-bit) secure-channel session key is required (Netlogon\\Parameters\\RequireStrongKey)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sealSecureChannel":{"name":"sealSecureChannel","type":"\u0004","is_mandatory":true,"title":"Whether secure-channel data is digitally encrypted when possible (Netlogon\\Parameters\\SealSecureChannel)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signSecureChannel":{"name":"signSecureChannel","type":"\u0004","is_mandatory":true,"title":"Whether secure-channel data is digitally signed when possible (Netlogon\\Parameters\\SignSecureChannel)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vulnerableChannelAllowList":{"name":"vulnerableChannelAllowList","type":"\u0007","is_mandatory":true,"title":"Allow list of vulnerable Netlogon secure channels (Netlogon\\Parameters\\vulnerablechannelallowlist, REG_SZ)","desc":"Machine names exempted from secure RPC enforcement (Zerologon / CVE-2020-1472 mitigation). A hardened system has an empty allow list.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows LSA Netlogon secure-channel settings","desc":"Netlogon secure-channel (domain member) settings under HKLM\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters. These control digital signing and sealing of secure-channel data, the machine account password change behavior and maximum age, strong session keys, NETBIOS discovery, the vulnerable-channel allow list, and inbound NTLM auditing in the domain. BlockNetbiosDiscovery is read from the GPO location HKLM\\SOFTWARE\\Policies\\Microsoft\\Netlogon\\Parameters. On/off settings are exposed as booleans and graded settings (the inbound NTLM audit bitmask and the maximum password age) as integers. Values are nullable so an absent value is distinguishable from an explicit false or 0.","private":true,"min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.optionalFeature":{"id":"windows.optionalFeature","name":"windows.optionalFeature","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Feature description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Human-readable display name of the feature","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the feature is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Feature name (ID) of the optional feature (for example \"SMB1Protocol\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0005","is_mandatory":true,"title":"Feature state","desc":"The DISM feature state: 0 = Disabled, 1 = Enabled, 2 = Disable pending, 3 = Enable pending (a pending state takes effect after the next reboot).","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Windows optional feature (desktop-only)","desc":"Windows optional feature reported by `Get-WindowsOptionalFeature -Online`, the desktop equivalent of server roles. Select one by its feature name, for example `windows.optionalFeature(name: \"SMB1Protocol\")`, to check whether a legacy or risky feature (such as SMBv1, Telnet client, or PowerShell v2) is turned on. `enabled` is the simple boolean; `state` carries the underlying DISM feature state for more granular checks.","private":true,"min_provider_version":"11.2.6","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.powershell":{"id":"windows.powershell","name":"windows.powershell","fields":{"executionPolicy":{"name":"executionPolicy","type":"\u0007","title":"PowerShell execution policy (PowerShell\\ExecutionPolicy)","desc":"The machine-wide execution policy string set by Group Policy, e.g. \"AllSigned\", \"RemoteSigned\", or \"Restricted\". Null when the value is absent.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scriptBlockLogging":{"name":"scriptBlockLogging","type":"\u001bwindows.powershell.scriptBlockLogging","title":"Script Block Logging policy (PowerShell\\ScriptBlockLogging)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"transcription":{"name":"transcription","type":"\u001bwindows.powershell.transcription","title":"Transcription policy (PowerShell\\Transcription)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows PowerShell logging policy","desc":"PowerShell logging settings configured via Group Policy under HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell: Script Block Logging, Transcription, and the machine execution policy. These are GPO-only values with no effective fallback, so when a value is absent the corresponding field is null, which is distinguishable from an explicit 0. Read from the registry, so it is available even on connections that cannot run commands.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.powershell.scriptBlockLogging":{"id":"windows.powershell.scriptBlockLogging","name":"windows.powershell.scriptBlockLogging","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether script block logging is enabled (EnableScriptBlockLogging); null when the value is absent","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"PowerShell Script Block Logging policy","desc":"Script Block Logging policy under HKLM\\SOFTWARE\\Policies \\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging. Script block logging records the deobfuscated contents of scripts and commands to the event log, a key control for detecting malicious PowerShell. This is a GPO-only value; when it is absent the field is null, distinguishable from an explicit 0.","private":true,"min_provider_version":"13.29.1","defaults":"enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.powershell.transcription":{"id":"windows.powershell.transcription","name":"windows.powershell.transcription","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether PowerShell transcription is enabled (EnableTranscripting); null when the value is absent","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"PowerShell Transcription policy","desc":"Transcription policy under HKLM\\SOFTWARE\\Policies\\Microsoft \\Windows\\PowerShell\\Transcription. Transcription writes a record of every PowerShell session (input and output) to text files. This is a GPO-only value; when it is absent the field is null, distinguishable from an explicit 0.","private":true,"min_provider_version":"13.29.1","defaults":"enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.rdp":{"id":"windows.rdp","name":"windows.rdp","fields":{"alwaysPromptForPassword":{"name":"alwaysPromptForPassword","type":"\u0004","title":"Whether the user is always prompted for a password on connection (fPromptForPassword)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"clipboardServerToClientLevel":{"name":"clipboardServerToClientLevel","type":"\u0005","title":"Server-to-client clipboard redirection level (SCClipLevel)","desc":"The raw SCClipLevel DWORD. 0 disables clipboard transfers from the server to the client; higher values permit progressively more content. Resolves to 3 (unrestricted) when the policy is not configured.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cloudClipboardIntegrationDisabled":{"name":"cloudClipboardIntegrationDisabled","type":"\u0004","title":"Whether RDP Cloud Clipboard integration for server-to-client data transfer is disabled (DisableCloudClipboardIntegration)","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"comPortRedirectionDisabled":{"name":"comPortRedirectionDisabled","type":"\u0004","title":"Whether client COM port redirection is disabled (fDisableCcm)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"connectionsDenied":{"name":"connectionsDenied","type":"\u0004","title":"Whether Remote Desktop connections to this host are denied (fDenyTSConnections)","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"deleteTempDirsOnExit":{"name":"deleteTempDirsOnExit","type":"\u0004","title":"Whether temporary folders are deleted when the session exits (DeleteTempDirsOnExit)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"driveRedirectionDisabled":{"name":"driveRedirectionDisabled","type":"\u0004","title":"Whether client drive redirection is disabled (fDisableCdm)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"endSessionWhenTimeLimitReached":{"name":"endSessionWhenTimeLimitReached","type":"\u0004","title":"Whether a session is ended rather than disconnected when a time limit is reached (fResetBroken)","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"locationRedirectionDisabled":{"name":"locationRedirectionDisabled","type":"\u0004","title":"Whether client location redirection is disabled (fDisableLocationRedir)","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lptPortRedirectionDisabled":{"name":"lptPortRedirectionDisabled","type":"\u0004","title":"Whether client LPT port redirection is disabled (fDisableLPT)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"maxDisconnectionTimeMs":{"name":"maxDisconnectionTimeMs","type":"\u0005","title":"Time limit in milliseconds for disconnected sessions, 0 to never end them (MaxDisconnectionTime)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"maxIdleTimeMs":{"name":"maxIdleTimeMs","type":"\u0005","title":"Time limit in milliseconds for active but idle sessions, 0 for no limit (MaxIdleTime)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"minEncryptionLevel":{"name":"minEncryptionLevel","type":"\u0005","title":"Minimum client connection encryption level (MinEncryptionLevel)","desc":"One of 1 (Low), 2 (Client Compatible), 3 (High), or 4 (FIPS Compliant).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"networkLevelAuthentication":{"name":"networkLevelAuthentication","type":"\u0004","title":"Whether Network Level Authentication is required (UserAuthentication)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"offerRemoteAssistanceAllowed":{"name":"offerRemoteAssistanceAllowed","type":"\u0004","title":"Whether offer (unsolicited) Remote Assistance is allowed (fAllowUnsolicited)","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"passwordSavingDisabled":{"name":"passwordSavingDisabled","type":"\u0004","title":"Whether saving of Remote Desktop passwords is disabled (DisablePasswordSaving)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"perSessionTempDirsUsed":{"name":"perSessionTempDirsUsed","type":"\u0004","title":"Whether per-session temporary folders are used (PerSessionTempDir)","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pnpDeviceRedirectionDisabled":{"name":"pnpDeviceRedirectionDisabled","type":"\u0004","title":"Whether supported Plug and Play device redirection is disabled (fDisablePNPRedir)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"secureRpcRequired":{"name":"secureRpcRequired","type":"\u0004","title":"Whether secure RPC communication is required (fEncryptRPCTraffic)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"securityLayer":{"name":"securityLayer","type":"\u0005","title":"RDP security layer (SecurityLayer)","desc":"One of 0 (native RDP), 1 (Negotiate), or 2 (SSL/TLS).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"singleSessionPerUser":{"name":"singleSessionPerUser","type":"\u0004","title":"Whether each user is restricted to a single Remote Desktop session (fSingleSessionPerUser)","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"solicitedRemoteAssistanceAllowed":{"name":"solicitedRemoteAssistanceAllowed","type":"\u0004","title":"Whether solicited Remote Assistance (users requesting help) is allowed (fAllowToGetHelp)","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uiAutomationRedirectionEnabled":{"name":"uiAutomationRedirectionEnabled","type":"\u0004","title":"Whether UI Automation redirection is enabled (EnableUiaRedirection)","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"webAuthnRedirectionDisabled":{"name":"webAuthnRedirectionDisabled","type":"\u0004","title":"Whether WebAuthn (FIDO2 security key) redirection is disabled (fDisableWebAuthn)","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Remote Desktop / Terminal Services configuration","desc":"Effective Remote Desktop (Terminal Services) policy posture: whether Network Level Authentication is required, the negotiated security layer and minimum client encryption level, device and resource redirection toggles, credential handling, and session idle / disconnection time limits. Each field resolves the Group Policy value (HKLM\\SOFTWARE\\Policies\\Microsoft \\Windows NT\\Terminal Services) first, then the per-listener configuration (HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp), and finally the documented Windows default when neither is set, so audits can assert the effective state without handling missing registry values.","min_provider_version":"13.22.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.schannel":{"id":"windows.schannel","name":"windows.schannel","fields":{"cipherSuites":{"name":"cipherSuites","type":"\u0019\u0007","title":"Ordered TLS cipher suite list (REG_MULTI_SZ Functions under ...\\SSL\\00010002)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ellipticCurves":{"name":"ellipticCurves","type":"\u0019\u0007","title":"Ordered TLS elliptic-curve / supported-group list (REG_MULTI_SZ Functions under ...\\SSL\\00010003)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pqcKeyExchangeEnabled":{"name":"pqcKeyExchangeEnabled","type":"\u0004","title":"Whether a post-quantum ML-KEM key-exchange group is enabled (any ellipticCurves entry contains \"MLKEM\", case-insensitive)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Schannel TLS configuration","desc":"Schannel (Secure Channel) TLS cipher-suite and supported-group configuration that backs the Microsoft TLS/SSL stack, read from the effective local Schannel store under HKLM\\SYSTEM\\CurrentControlSet\\Control\\Cryptography\\Configuration\\Local\\SSL. The ordered cipher-suite list is the REG_MULTI_SZ `Functions` value under the 00010002 subkey and the ordered elliptic-curve / supported-group list is the REG_MULTI_SZ `Functions` value under the 00010003 subkey. On Windows 11 24H2 and Windows Server 2025 the supported-group list is where post-quantum ML-KEM key-exchange groups (for example secp256r1_mlkem768) appear once enabled.  When a key or value is absent (the common case on older Windows, on systems using the default order, and on non-Windows platforms) the list accessors resolve to an empty list and pqcKeyExchangeEnabled resolves to false rather than failing.","min_provider_version":"13.34.4","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.scheduledTask":{"id":"windows.scheduledTask","name":"windows.scheduledTask","fields":{"action":{"name":"action","type":"\u001bwindows.scheduledTask.action","title":"Action performed by a Windows scheduled task","desc":"Single executable action a task performs: the program it runs (`execute`), the command-line `arguments` passed to it, and the `workingDirectory` it runs in. Inspect `execute` to spot tasks that launch scripts, interpreters, or binaries from writable or unexpected locations.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"actions":{"name":"actions","type":"\u0019\u001bwindows.scheduledTask.action","title":"Actions the task executes when it runs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"author":{"name":"author","type":"\u0007","is_mandatory":true,"title":"Author of the task","provider":"go.mondoo.com/cnquery/v9/providers/os"},"date":{"name":"date","type":"\t","is_mandatory":true,"title":"Date the task was registered","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description of the task","provider":"go.mondoo.com/cnquery/v9/providers/os"},"documentation":{"name":"documentation","type":"\u0007","is_mandatory":true,"title":"Documentation or notes associated with the task","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the task is enabled to run","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastRunTime":{"name":"lastRunTime","type":"\t","title":"Time the task last ran","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastTaskResult":{"name":"lastTaskResult","type":"\u0005","title":"Exit/result code from the most recent run","provider":"go.mondoo.com/cnquery/v9/providers/os"},"missedRuns":{"name":"missedRuns","type":"\u0005","title":"Number of times the task was scheduled to run but did not","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Task name (the leaf identifier within its folder)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nextRunTime":{"name":"nextRunTime","type":"\t","title":"Time the task is next scheduled to run","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Folder path the task is registered under (for example \"\\Microsoft\\Windows\\Defrag\\\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"principal":{"name":"principal","type":"\u001bwindows.scheduledTask.principal","title":"Security context the task runs under","provider":"go.mondoo.com/cnquery/v9/providers/os"},"securityDescriptor":{"name":"securityDescriptor","type":"\u0007","is_mandatory":true,"title":"Security descriptor (SDDL) controlling who can read or run the task","provider":"go.mondoo.com/cnquery/v9/providers/os"},"settings":{"name":"settings","type":"\u001bwindows.scheduledTask.settings","title":"Conditions and behavior that govern how the task runs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Source the task was registered from","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Run state","desc":"One of \"Unknown\", \"Disabled\", \"Queued\", \"Ready\", or \"Running\".","provider":"go.mondoo.com/cnquery/v9/providers/os"},"trigger":{"name":"trigger","type":"\u001bwindows.scheduledTask.trigger","title":"Trigger that launches a Windows scheduled task","desc":"Single condition that starts a task. The `type` discriminates the kind of trigger (\"daily\", \"weekly\", \"monthly\", \"monthlyDOW\", \"boot\", \"logon\", \"registration\", \"time\", \"event\", \"idle\", or \"sessionStateChange\") and determines which of the schedule fields apply: `daysInterval` and `randomDelay` for daily, `weeksInterval`/`daysOfWeek` for weekly, `delay` for boot/logon/event triggers, and so on. Common fields cover whether the trigger is `enabled`, its active window (`startBoundary`, `endBoundary`), the `executionTimeLimit`, and any repetition pattern.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"triggers":{"name":"triggers","type":"\u0019\u001bwindows.scheduledTask.trigger","title":"Conditions that launch the task","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uri":{"name":"uri","type":"\u0007","is_mandatory":true,"title":"Fully qualified task identifier combining path and name","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Task Scheduler task","desc":"Registered task from the Windows Task Scheduler: its identity (`name`, `path`, `uri`), run `state`, whether it is `enabled`, descriptive metadata (`description`, `author`), and the security context it runs under via `principal`. The `actions` it executes, the `triggers` that launch it, and its full `settings` are exposed as nested resources, while `lastRunTime`, `nextRunTime`, `lastTaskResult`, and `missedRuns` report the most recent run-time information. Audit which tasks run, as whom, and on what schedule, for example `windows.scheduledTasks.where(enabled).where(principal.runLevel == \"Highest\")` surfaces enabled tasks running with the highest available privileges.","private":true,"min_provider_version":"13.25.1","defaults":"path name state enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.scheduledTask.action":{"id":"windows.scheduledTask.action","name":"windows.scheduledTask.action","fields":{"arguments":{"name":"arguments","type":"\u0007","is_mandatory":true,"title":"Command-line arguments passed to the program","provider":"go.mondoo.com/cnquery/v9/providers/os"},"execute":{"name":"execute","type":"\u0007","is_mandatory":true,"title":"Program or command the action runs","provider":"go.mondoo.com/cnquery/v9/providers/os"},"workingDirectory":{"name":"workingDirectory","type":"\u0007","is_mandatory":true,"title":"Working directory the program runs in","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Action performed by a Windows scheduled task","desc":"Single executable action a task performs: the program it runs (`execute`), the command-line `arguments` passed to it, and the `workingDirectory` it runs in. Inspect `execute` to spot tasks that launch scripts, interpreters, or binaries from writable or unexpected locations.","private":true,"min_provider_version":"13.25.1","defaults":"execute arguments","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.scheduledTask.principal":{"id":"windows.scheduledTask.principal","name":"windows.scheduledTask.principal","fields":{"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Friendly name of the principal","provider":"go.mondoo.com/cnquery/v9/providers/os"},"groupId":{"name":"groupId","type":"\u0007","is_mandatory":true,"title":"Group the task is associated with, when run for a group rather than a user","provider":"go.mondoo.com/cnquery/v9/providers/os"},"logonType":{"name":"logonType","type":"\u0007","is_mandatory":true,"title":"How credentials are obtained","desc":"One of \"None\", \"Password\", \"S4U\", \"Interactive\", \"Group\", \"ServiceAccount\", or \"InteractiveOrPassword\".","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runLevel":{"name":"runLevel","type":"\u0007","is_mandatory":true,"title":"Privilege level the task runs with","desc":"One of \"Limited\" or \"Highest\".","provider":"go.mondoo.com/cnquery/v9/providers/os"},"userId":{"name":"userId","type":"\u0007","is_mandatory":true,"title":"User account the task runs as","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Security context of a Windows scheduled task","desc":"Account a task runs as: the `userId` or `groupId` it is associated with, the `logonType` used to obtain credentials, and the `runLevel` that determines whether it runs with the highest available privileges. A task whose `runLevel` is \"Highest\" and whose principal is a privileged account is a common privilege-escalation surface.","private":true,"min_provider_version":"13.25.1","defaults":"userId logonType runLevel","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.scheduledTask.settings":{"id":"windows.scheduledTask.settings","name":"windows.scheduledTask.settings","fields":{"allowDemandStart":{"name":"allowDemandStart","type":"\u0004","is_mandatory":true,"title":"Whether the task can be started on demand","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowHardTerminate":{"name":"allowHardTerminate","type":"\u0004","is_mandatory":true,"title":"Whether the task can be terminated with end-task requests","provider":"go.mondoo.com/cnquery/v9/providers/os"},"compatibility":{"name":"compatibility","type":"\u0007","is_mandatory":true,"title":"Lowest Task Scheduler version the task is compatible with","provider":"go.mondoo.com/cnquery/v9/providers/os"},"deleteExpiredTaskAfter":{"name":"deleteExpiredTaskAfter","type":"\u0007","is_mandatory":true,"title":"Time the task is kept after it expires, as an ISO 8601 duration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disallowStartIfOnBatteries":{"name":"disallowStartIfOnBatteries","type":"\u0004","is_mandatory":true,"title":"Whether the task is prevented from starting while on battery power","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disallowStartOnRemoteAppSession":{"name":"disallowStartOnRemoteAppSession","type":"\u0004","is_mandatory":true,"title":"Whether the task is prevented from starting on a remote application session","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the task is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"executionTimeLimit":{"name":"executionTimeLimit","type":"\u0007","is_mandatory":true,"title":"Maximum time the task may run, as an ISO 8601 duration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hidden":{"name":"hidden","type":"\u0004","is_mandatory":true,"title":"Whether the task is hidden from the default Task Scheduler view","provider":"go.mondoo.com/cnquery/v9/providers/os"},"idleDuration":{"name":"idleDuration","type":"\u0007","is_mandatory":true,"title":"How long the computer must be idle before the task runs, as an ISO 8601 duration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"idleRestartOnIdle":{"name":"idleRestartOnIdle","type":"\u0004","is_mandatory":true,"title":"Whether the task restarts when the computer becomes idle again","provider":"go.mondoo.com/cnquery/v9/providers/os"},"idleStopOnIdleEnd":{"name":"idleStopOnIdleEnd","type":"\u0004","is_mandatory":true,"title":"Whether the task stops when the computer is no longer idle","provider":"go.mondoo.com/cnquery/v9/providers/os"},"idleWaitTimeout":{"name":"idleWaitTimeout","type":"\u0007","is_mandatory":true,"title":"How long to wait for an idle condition, as an ISO 8601 duration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"multipleInstances":{"name":"multipleInstances","type":"\u0007","is_mandatory":true,"title":"Behavior when an instance of the task is already running","desc":"One of \"IgnoreNew\", \"Parallel\", \"Queue\", or \"StopExisting\".","provider":"go.mondoo.com/cnquery/v9/providers/os"},"networkId":{"name":"networkId","type":"\u0007","is_mandatory":true,"title":"Identifier of the network profile the task is tied to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"networkName":{"name":"networkName","type":"\u0007","is_mandatory":true,"title":"Name of the network profile the task is tied to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Scheduling priority, from 0 (highest) to 10 (lowest)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"restartCount":{"name":"restartCount","type":"\u0005","is_mandatory":true,"title":"Number of times the task is restarted after a failure","provider":"go.mondoo.com/cnquery/v9/providers/os"},"restartInterval":{"name":"restartInterval","type":"\u0007","is_mandatory":true,"title":"Time to wait between restart attempts, as an ISO 8601 duration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runOnlyIfIdle":{"name":"runOnlyIfIdle","type":"\u0004","is_mandatory":true,"title":"Whether the task runs only when the computer is idle","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runOnlyIfNetworkAvailable":{"name":"runOnlyIfNetworkAvailable","type":"\u0004","is_mandatory":true,"title":"Whether the task runs only when a network connection is available","provider":"go.mondoo.com/cnquery/v9/providers/os"},"startWhenAvailable":{"name":"startWhenAvailable","type":"\u0004","is_mandatory":true,"title":"Whether the task starts as soon as possible after a missed scheduled start","provider":"go.mondoo.com/cnquery/v9/providers/os"},"stopIfGoingOnBatteries":{"name":"stopIfGoingOnBatteries","type":"\u0004","is_mandatory":true,"title":"Whether a running task is stopped when the computer switches to battery power","provider":"go.mondoo.com/cnquery/v9/providers/os"},"wakeToRun":{"name":"wakeToRun","type":"\u0004","is_mandatory":true,"title":"Whether the task wakes the computer to run","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Conditions and behavior governing a Windows scheduled task","desc":"Settings that control how a task runs: whether it is `enabled` or `hidden`, how it behaves on battery power (`disallowStartIfOnBatteries`, `stopIfGoingOnBatteries`), what happens when an instance is already running (`multipleInstances`), restart-on-failure behavior (`restartCount`, `restartInterval`), idle conditions, and execution limits.","private":true,"min_provider_version":"13.25.1","defaults":"enabled hidden priority","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.scheduledTask.trigger":{"id":"windows.scheduledTask.trigger","name":"windows.scheduledTask.trigger","fields":{"daysInterval":{"name":"daysInterval","type":"\u0005","is_mandatory":true,"title":"Number of days between runs, for daily triggers","provider":"go.mondoo.com/cnquery/v9/providers/os"},"daysOfWeek":{"name":"daysOfWeek","type":"\u0005","is_mandatory":true,"title":"Bitmask of days the task runs, for weekly and monthly-day-of-week triggers","provider":"go.mondoo.com/cnquery/v9/providers/os"},"delay":{"name":"delay","type":"\u0007","is_mandatory":true,"title":"Delay after the triggering event before the task starts, as an ISO 8601 duration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the trigger is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"endBoundary":{"name":"endBoundary","type":"\t","is_mandatory":true,"title":"Latest time the trigger is active","provider":"go.mondoo.com/cnquery/v9/providers/os"},"executionTimeLimit":{"name":"executionTimeLimit","type":"\u0007","is_mandatory":true,"title":"Maximum time the task may run when started by this trigger, as an ISO 8601 duration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"randomDelay":{"name":"randomDelay","type":"\u0007","is_mandatory":true,"title":"Random delay added before starting, as an ISO 8601 duration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"repetitionDuration":{"name":"repetitionDuration","type":"\u0007","is_mandatory":true,"title":"How long the task keeps repeating after the trigger fires, as an ISO 8601 duration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"repetitionInterval":{"name":"repetitionInterval","type":"\u0007","is_mandatory":true,"title":"Interval between repeated runs while the trigger is active, as an ISO 8601 duration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"repetitionStopAtDurationEnd":{"name":"repetitionStopAtDurationEnd","type":"\u0004","is_mandatory":true,"title":"Whether a running instance is stopped when the repetition duration ends","provider":"go.mondoo.com/cnquery/v9/providers/os"},"startBoundary":{"name":"startBoundary","type":"\t","is_mandatory":true,"title":"Earliest time the trigger is active","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Kind of trigger","desc":"One of \"daily\", \"weekly\", \"monthly\", \"monthlyDOW\", \"boot\", \"logon\", \"registration\", \"time\", \"event\", \"idle\", or \"sessionStateChange\".","provider":"go.mondoo.com/cnquery/v9/providers/os"},"userId":{"name":"userId","type":"\u0007","is_mandatory":true,"title":"User the logon trigger is scoped to, when restricted to a specific user","provider":"go.mondoo.com/cnquery/v9/providers/os"},"weeksInterval":{"name":"weeksInterval","type":"\u0005","is_mandatory":true,"title":"Number of weeks between runs, for weekly triggers","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Trigger that launches a Windows scheduled task","desc":"Single condition that starts a task. The `type` discriminates the kind of trigger (\"daily\", \"weekly\", \"monthly\", \"monthlyDOW\", \"boot\", \"logon\", \"registration\", \"time\", \"event\", \"idle\", or \"sessionStateChange\") and determines which of the schedule fields apply: `daysInterval` and `randomDelay` for daily, `weeksInterval`/`daysOfWeek` for weekly, `delay` for boot/logon/event triggers, and so on. Common fields cover whether the trigger is `enabled`, its active window (`startBoundary`, `endBoundary`), the `executionTimeLimit`, and any repetition pattern.","private":true,"min_provider_version":"13.25.1","defaults":"type enabled startBoundary","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.security":{"id":"windows.security","name":"windows.security","fields":{"health":{"name":"health","type":"\u001bwindows.security.health","title":"Windows Security Center health","desc":"Aggregate protection status reported by the Windows Security Center: firewall, antivirus, anti-spyware, Automatic Updates, User Account Control (UAC), Internet Explorer security settings, and the Security Center service itself. Each control is exposed as a dict so audits can assert on whether it is present, enabled, and up to date.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"product":{"name":"product","type":"\u001bwindows.security.product","title":"Windows security product registered with Security Center","desc":"A single antivirus, anti-spyware, or firewall product reported by the Windows Security Center, including its human-readable name, GUID, and the decoded product and signature state. Iterated from `windows.security.products`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"products":{"name":"products","type":"\u0019\u001bwindows.security.product","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows registered security products","desc":"Antivirus, anti-spyware, and firewall providers registered with the Windows Security Center. Use `products` to verify that an up-to-date, enabled security product is present, for example `windows.security.products.where(type == \"antivirus\").any(productState == \"on\")`.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.security.health":{"id":"windows.security.health","name":"windows.security.health","fields":{"antiSpyware":{"name":"antiSpyware","type":"\n","is_mandatory":true,"title":"Anti-spyware protection status and details","provider":"go.mondoo.com/cnquery/v9/providers/os"},"antiVirus":{"name":"antiVirus","type":"\n","is_mandatory":true,"title":"Installed antivirus software status and details","provider":"go.mondoo.com/cnquery/v9/providers/os"},"autoUpdate":{"name":"autoUpdate","type":"\n","is_mandatory":true,"title":"Windows Update automatic update settings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"firewall":{"name":"firewall","type":"\n","is_mandatory":true,"title":"Windows Firewall status and configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"internetSettings":{"name":"internetSettings","type":"\n","is_mandatory":true,"title":"Internet settings information","provider":"go.mondoo.com/cnquery/v9/providers/os"},"securityCenterService":{"name":"securityCenterService","type":"\n","is_mandatory":true,"title":"Windows Security Center service status","provider":"go.mondoo.com/cnquery/v9/providers/os"},"uac":{"name":"uac","type":"\n","is_mandatory":true,"title":"User Account Control (UAC) configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Security Center health","desc":"Aggregate protection status reported by the Windows Security Center: firewall, antivirus, anti-spyware, Automatic Updates, User Account Control (UAC), Internet Explorer security settings, and the Security Center service itself. Each control is exposed as a dict so audits can assert on whether it is present, enabled, and up to date.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.security.product":{"id":"windows.security.product","name":"windows.security.product","fields":{"guid":{"name":"guid","type":"\u0007","is_mandatory":true,"title":"Product GUID assigned by Security Center","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Product name (e.g. \"Windows Defender\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"productState":{"name":"productState","type":"\u0007","is_mandatory":true,"title":"Decoded product state (e.g. on, off, snoozed, expired)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"signatureState":{"name":"signatureState","type":"\u0007","is_mandatory":true,"title":"Decoded signature/definition state (e.g. up-to-date or out-of-date)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0005","is_mandatory":true,"title":"Raw product state bitfield reported by Security Center","provider":"go.mondoo.com/cnquery/v9/providers/os"},"timestamp":{"name":"timestamp","type":"\t","is_mandatory":true,"title":"Time the product state was last reported","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Product category: antivirus, antispyware, or firewall","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows security product registered with Security Center","desc":"A single antivirus, anti-spyware, or firewall product reported by the Windows Security Center, including its human-readable name, GUID, and the decoded product and signature state. Iterated from `windows.security.products`.","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.serverFeature":{"id":"windows.serverFeature","name":"windows.serverFeature","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Feature description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Human-readable display name of the feature","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installState":{"name":"installState","type":"\u0005","is_mandatory":true,"title":"Feature installation state","desc":"The ServerManager InstallState value from Get-WindowsFeature, distinguishing installed, available (not installed), and removed (payload removed from the image) features.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"installed":{"name":"installed","type":"\u0004","is_mandatory":true,"title":"Whether the feature is installed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Command name (ID) of the role, role service, or feature (for example \"Web-Server\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Feature full path","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Windows Server role, role service, or feature","desc":"Installable Windows Server component reported by `Get-WindowsFeature`. Select one by its command name, for example `windows.serverFeature(name: \"Web-Server\")`, to check whether a role such as IIS, DNS, or Hyper-V is present. `installed` is the simple boolean check, while `installState` distinguishes fully installed from removed or available-for-install states.","private":true,"min_provider_version":"11.2.6","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.smartScreen":{"id":"windows.smartScreen","name":"windows.smartScreen","fields":{"edgeEnabled":{"name":"edgeEnabled","type":"\u0004","title":"Whether SmartScreen is enabled for Microsoft Edge","provider":"go.mondoo.com/cnquery/v9/providers/os"},"edgePreventOverride":{"name":"edgePreventOverride","type":"\u0004","title":"Whether users are prevented from bypassing Edge SmartScreen warnings about sites","provider":"go.mondoo.com/cnquery/v9/providers/os"},"edgePreventOverrideForFiles":{"name":"edgePreventOverrideForFiles","type":"\u0004","title":"Whether users are prevented from bypassing Edge SmartScreen warnings about downloads","provider":"go.mondoo.com/cnquery/v9/providers/os"},"edgePuaEnabled":{"name":"edgePuaEnabled","type":"\u0004","title":"Whether Edge SmartScreen blocks potentially unwanted applications (PUA)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"explorerEnabled":{"name":"explorerEnabled","type":"\u0004","title":"Whether SmartScreen is enabled for Windows / File Explorer","provider":"go.mondoo.com/cnquery/v9/providers/os"},"explorerLevel":{"name":"explorerLevel","type":"\u0007","title":"Enforcement level for Windows / File Explorer SmartScreen","desc":"\"Block\" prevents the user from bypassing warnings; \"Warn\" lets the user continue; an empty string means no level is configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"storeAppsEnabled":{"name":"storeAppsEnabled","type":"\u0004","title":"Whether SmartScreen web-content evaluation is enabled for Microsoft Store apps","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Microsoft Defender SmartScreen","desc":"Microsoft Defender SmartScreen policy configuration across its three surfaces: Windows / File Explorer (which checks apps and files), the Microsoft Edge browser, and Microsoft Store apps. SmartScreen is configured through Group Policy registry values rather than a dedicated cmdlet; a value that has not been configured resolves to its disabled default (false, or an empty string for `explorerLevel`).","min_provider_version":"13.29.1","defaults":"explorerEnabled explorerLevel edgeEnabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.smb":{"id":"windows.smb","name":"windows.smb","fields":{"clientConfiguration":{"name":"clientConfiguration","type":"\u001bwindows.smb.clientConfiguration","title":"SMB client (LanmanWorkstation) registry configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"connection":{"name":"connection","type":"\u001bwindows.smb.connection","title":"Windows SMB connection","desc":"Single outbound SMB connection from this host to an SMB server: the `serverName`, `shareName`, authenticated `userName`, and negotiated `dialect`. Iterated from `windows.smb.connections`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"connections":{"name":"connections","type":"\u0019\u001bwindows.smb.connection","title":"Outbound SMB connections (this host connected to other SMB servers)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverConfiguration":{"name":"serverConfiguration","type":"\u001bwindows.smb.serverConfiguration","title":"SMB server (LanmanServer) registry configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"},"session":{"name":"session","type":"\u001bwindows.smb.session","title":"Windows SMB session","desc":"Single inbound SMB session: the connecting client's computer name and user, the SMB `dialect` negotiated, and the number of files the client has open. Iterated from `windows.smb.sessions`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"sessions":{"name":"sessions","type":"\u0019\u001bwindows.smb.session","title":"Active inbound SMB sessions (clients connected to this host)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"share":{"name":"share","type":"\u001bwindows.smb.share","title":"Windows SMB share","desc":"Single SMB share published by the host: its `name`, the local filesystem `path` it exposes, a `description`, the `scopeName` it is published under, and its `shareType`. Iterated from `windows.smb.shares`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"shares":{"name":"shares","type":"\u0019\u001bwindows.smb.share","title":"SMB shares published by this host","provider":"go.mondoo.com/cnquery/v9/providers/os"},"smbv1Enabled":{"name":"smbv1Enabled","type":"\u0004","title":"Whether the SMBv1 client driver (mrxsmb10) is enabled (Start != 4)","desc":"True when the mrxsmb10 service Start value is anything other than 4 (disabled). SMBv1 is deprecated and should be disabled.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows SMB (Server Message Block) server","desc":"SMB shares published by the host, active inbound client sessions, and outbound connections to other SMB servers, along with the server and client registry hardening configuration and whether the deprecated SMBv1 driver is still enabled. Backed by the `Get-SmbShare`, `Get-SmbSession`, and `Get-SmbConnection` PowerShell cmdlets plus registry reads.","min_provider_version":"13.28.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.smb.clientConfiguration":{"id":"windows.smb.clientConfiguration","name":"windows.smb.clientConfiguration","fields":{"allowInsecureGuestAuth":{"name":"allowInsecureGuestAuth","type":"\u0004","is_mandatory":true,"title":"Whether insecure guest logons are allowed (AllowInsecureGuestAuth)","desc":"Maps the AllowInsecureGuestAuth DWORD; 0 = disallowed (compliant). Null when unset, so an explicit 0 is distinguishable from absent.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditInsecureGuestLogon":{"name":"auditInsecureGuestLogon","type":"\u0004","is_mandatory":true,"title":"Whether to audit insecure guest logons (AuditInsecureGuestLogon)","desc":"Maps the AuditInsecureGuestLogon DWORD; 1 = auditing enabled. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditServerDoesNotSupportEncryption":{"name":"auditServerDoesNotSupportEncryption","type":"\u0004","is_mandatory":true,"title":"Whether to audit servers that do not support SMB encryption (AuditServerDoesNotSupportEncryption)","desc":"Maps the AuditServerDoesNotSupportEncryption DWORD; 1 = auditing enabled. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditServerDoesNotSupportSigning":{"name":"auditServerDoesNotSupportSigning","type":"\u0004","is_mandatory":true,"title":"Whether to audit servers that do not support SMB signing (AuditServerDoesNotSupportSigning)","desc":"Maps the AuditServerDoesNotSupportSigning DWORD; 1 = auditing enabled. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enablePlainTextPassword":{"name":"enablePlainTextPassword","type":"\u0004","is_mandatory":true,"title":"Whether the client sends plaintext passwords to SMB servers (EnablePlainTextPassword)","desc":"Maps the EnablePlainTextPassword DWORD; 0 = disabled (compliant). Null when unset, so an explicit 0 is distinguishable from absent.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enableSecuritySignature":{"name":"enableSecuritySignature","type":"\u0004","is_mandatory":true,"title":"Whether the client enables (offers) SMB packet signing (EnableSecuritySignature)","desc":"Maps the EnableSecuritySignature DWORD; 1 = enabled. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"minSmb2Dialect":{"name":"minSmb2Dialect","type":"\u0005","is_mandatory":true,"title":"Minimum SMB2 dialect the client will negotiate (MinSmb2Dialect)","desc":"Maps the MinSmb2Dialect DWORD. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"requireEncryption":{"name":"requireEncryption","type":"\u0004","is_mandatory":true,"title":"Whether the client requires SMB encryption (RequireEncryption)","desc":"Maps the RequireEncryption DWORD; 1 = required. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"requireSecuritySignature":{"name":"requireSecuritySignature","type":"\u0004","is_mandatory":true,"title":"Whether the client requires SMB packet signing (RequireSecuritySignature)","desc":"Maps the RequireSecuritySignature DWORD; 1 = required. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serviceStart":{"name":"serviceStart","type":"\u0005","is_mandatory":true,"title":"The LanmanWorkstation service Start value (registry Start)","desc":"Maps the LanmanWorkstation service Start DWORD (2 = automatic, 3 = manual, 4 = disabled). Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows SMB client configuration","desc":"SMB client (LanmanWorkstation) hardening settings sourced from the registry. Values configured through Group Policy (HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\LanmanWorkstation) take precedence over the service parameters (HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters). Integer and boolean fields whose compliant value is 0 are null when the value is not configured anywhere, so an explicit 0 can be told apart from absent.","private":true,"min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.smb.connection":{"id":"windows.smb.connection","name":"windows.smb.connection","fields":{"dialect":{"name":"dialect","type":"\u0007","is_mandatory":true,"title":"SMB dialect negotiated for the connection (e.g. 3.1.1)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverName":{"name":"serverName","type":"\u0007","is_mandatory":true,"title":"SMB server name the host is connected to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"shareName":{"name":"shareName","type":"\u0007","is_mandatory":true,"title":"Share name on the server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"userName":{"name":"userName","type":"\u0007","is_mandatory":true,"title":"User account used for the connection","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows SMB connection","desc":"Single outbound SMB connection from this host to an SMB server: the `serverName`, `shareName`, authenticated `userName`, and negotiated `dialect`. Iterated from `windows.smb.connections`.","private":true,"min_provider_version":"13.28.2","defaults":"serverName shareName","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.smb.serverConfiguration":{"id":"windows.smb.serverConfiguration","name":"windows.smb.serverConfiguration","fields":{"auditClientDoesNotSupportEncryption":{"name":"auditClientDoesNotSupportEncryption","type":"\u0004","is_mandatory":true,"title":"Whether to audit clients that do not support SMB encryption (AuditClientDoesNotSupportEncryption)","desc":"Maps the AuditClientDoesNotSupportEncryption DWORD; 1 = auditing enabled. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"auditClientDoesNotSupportSigning":{"name":"auditClientDoesNotSupportSigning","type":"\u0004","is_mandatory":true,"title":"Whether to audit clients that do not support SMB signing (AuditClientDoesNotSupportSigning)","desc":"Maps the AuditClientDoesNotSupportSigning DWORD; 1 = auditing enabled. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"autoDisconnectMinutes":{"name":"autoDisconnectMinutes","type":"\u0005","is_mandatory":true,"title":"Idle time in minutes before a session is disconnected (AutoDisconnect)","desc":"Maps the AutoDisconnect DWORD. Null when unset. The CIS-recommended value is 15 minutes or less.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enableAuthRateLimiter":{"name":"enableAuthRateLimiter","type":"\u0004","is_mandatory":true,"title":"Whether the SMB authentication rate limiter is enabled (EnableAuthRateLimiter)","desc":"Maps the EnableAuthRateLimiter DWORD; 1 = enabled. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enableForcedLogoff":{"name":"enableForcedLogoff","type":"\u0004","is_mandatory":true,"title":"Whether clients are forced to log off when logon hours expire (enableforcedlogoff)","desc":"Maps the enableforcedlogoff DWORD; 1 = forced logoff enabled. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enableSecuritySignature":{"name":"enableSecuritySignature","type":"\u0004","is_mandatory":true,"title":"Whether the server enables (offers) SMB packet signing (EnableSecuritySignature)","desc":"Maps the EnableSecuritySignature DWORD; 1 = enabled. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"invalidAuthenticationDelayMs":{"name":"invalidAuthenticationDelayMs","type":"\u0005","is_mandatory":true,"title":"Delay in milliseconds applied to invalid SMB authentication attempts (InvalidAuthenticationDelayTimeInMs)","desc":"Maps the InvalidAuthenticationDelayTimeInMs DWORD. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nullSessionPipes":{"name":"nullSessionPipes","type":"\u0019\u0007","is_mandatory":true,"title":"Named pipes accessible to anonymous (null session) users (NullSessionPipes)","desc":"The REG_MULTI_SZ NullSessionPipes value. Empty when unset; a compliant configuration is an empty list.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"nullSessionShares":{"name":"nullSessionShares","type":"\u0019\u0007","is_mandatory":true,"title":"Shares accessible to anonymous (null session) users (NullSessionShares)","desc":"The REG_MULTI_SZ NullSessionShares value. Empty when unset; a compliant configuration is an empty list.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"requireSecuritySignature":{"name":"requireSecuritySignature","type":"\u0004","is_mandatory":true,"title":"Whether the server requires SMB packet signing (RequireSecuritySignature)","desc":"Maps the RequireSecuritySignature DWORD; 1 = required. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"restrictNullSessionAccess":{"name":"restrictNullSessionAccess","type":"\u0004","is_mandatory":true,"title":"Whether anonymous (null session) access is restricted (RestrictNullSessAccess)","desc":"Maps the RestrictNullSessAccess DWORD; 1 = restricted. Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serverNameHardeningLevel":{"name":"serverNameHardeningLevel","type":"\u0005","is_mandatory":true,"title":"SMB server name hardening level (SMBServerNameHardeningLevel)","desc":"Maps the SMBServerNameHardeningLevel DWORD (0, 1, or 2). Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serviceStart":{"name":"serviceStart","type":"\u0005","is_mandatory":true,"title":"The LanmanServer service Start value (registry Start)","desc":"Maps the LanmanServer service Start DWORD (2 = automatic, 3 = manual, 4 = disabled). Null when unset.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"smb1Enabled":{"name":"smb1Enabled","type":"\u0004","is_mandatory":true,"title":"Whether SMBv1 is enabled on the server (SMB1)","desc":"Maps the SMB1 DWORD; 1 = enabled, 0 = disabled. Null when unset (in which case the OS default applies). SMBv1 should be disabled.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows SMB server configuration","desc":"SMB server (LanmanServer) hardening settings sourced from the registry. Values configured through Group Policy (HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\LanmanServer) take precedence over the service parameters (HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters). Integer and boolean fields whose compliant value is 0 are null when the value is not configured anywhere, so an explicit 0 can be told apart from an absent value.","private":true,"min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.smb.session":{"id":"windows.smb.session","name":"windows.smb.session","fields":{"clientComputerName":{"name":"clientComputerName","type":"\u0007","is_mandatory":true,"title":"Client computer name or IP address","provider":"go.mondoo.com/cnquery/v9/providers/os"},"clientUserName":{"name":"clientUserName","type":"\u0007","is_mandatory":true,"title":"User account the session authenticated as","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dialect":{"name":"dialect","type":"\u0007","is_mandatory":true,"title":"SMB dialect negotiated for the session (e.g. 3.1.1)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"numOpens":{"name":"numOpens","type":"\u0005","is_mandatory":true,"title":"Number of files the client currently has open","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows SMB session","desc":"Single inbound SMB session: the connecting client's computer name and user, the SMB `dialect` negotiated, and the number of files the client has open. Iterated from `windows.smb.sessions`.","private":true,"min_provider_version":"13.28.2","defaults":"clientComputerName clientUserName","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.smb.share":{"id":"windows.smb.share","name":"windows.smb.share","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Share description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Share name (e.g. C$, SYSVOL, or a custom share name)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Local filesystem path backing the share","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scopeName":{"name":"scopeName","type":"\u0007","is_mandatory":true,"title":"Scope name the share is published under (e.g. * for the default scope)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"shareType":{"name":"shareType","type":"\u0007","is_mandatory":true,"title":"Share type (e.g. FileSystemDirectory)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows SMB share","desc":"Single SMB share published by the host: its `name`, the local filesystem `path` it exposes, a `description`, the `scopeName` it is published under, and its `shareType`. Iterated from `windows.smb.shares`.","private":true,"min_provider_version":"13.28.2","defaults":"name path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.spooler":{"id":"windows.spooler","name":"windows.spooler","fields":{"addPrinterDriversRestricted":{"name":"addPrinterDriversRestricted","type":"\u0004","title":"Whether adding printer drivers is restricted to administrators","desc":"Maps the LanMan print provider AddPrinterDrivers value (Control\\Print\\Providers\\LanMan Print Services\\Servers\\AddPrinterDrivers). Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"copyFilesPolicy":{"name":"copyFilesPolicy","type":"\u0004","title":"Whether the spooler restricts copied files to the Windows color system (Printers\\CopyFilesPolicy). Null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disabled":{"name":"disabled","type":"\u0004","title":"Whether the Print Spooler service is disabled (Start == 4)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"httpPrintingDisabled":{"name":"httpPrintingDisabled","type":"\u0004","title":"Whether printing over HTTP is disabled (Printers\\DisableHTTPPrinting)","desc":"Defaults to false (HTTP printing allowed) when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ipp":{"name":"ipp","type":"\u001bwindows.spooler.ipp","title":"Internet Printing Protocol (IPP) certificate validation settings (Printers\\IPP)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pointAndPrint":{"name":"pointAndPrint","type":"\u001bwindows.spooler.pointAndPrint","title":"Point and Print restriction settings (Printers\\PointAndPrint)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"redirectionGuardPolicy":{"name":"redirectionGuardPolicy","type":"\u0004","title":"Whether Redirection Guard is enabled (Printers\\RedirectionguardPolicy). Null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"registerRemoteRpcEndpoint":{"name":"registerRemoteRpcEndpoint","type":"\u0004","title":"Whether incoming remote RPC connections to the spooler are allowed (Printers\\RegisterSpoolerRemoteRpcEndPoint)","desc":"The hardened state is false (the remote RPC endpoint is disabled). Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rpc":{"name":"rpc","type":"\u001bwindows.spooler.rpc","title":"Spooler RPC settings (Printers\\RPC)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rpcAuthnLevelPrivacyEnabled":{"name":"rpcAuthnLevelPrivacyEnabled","type":"\u0004","title":"Whether incoming RPC connections to the spooler require packet privacy (Control\\Print\\RpcAuthnLevelPrivacyEnabled)","desc":"Defaults to true (packet privacy enabled), the modern Windows default, when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"startMode":{"name":"startMode","type":"\u0005","title":"Print Spooler service start type (HKLM\\SYSTEM\\CurrentControlSet\\Services\\Spooler\\Start)","desc":"One of 2 (Automatic), 3 (Manual), or 4 (Disabled). Null when the value is not present.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"webPnpDownloadDisabled":{"name":"webPnpDownloadDisabled","type":"\u0004","title":"Whether downloading of print drivers over HTTP / Web Point-and-Print is disabled (Printers\\DisableWebPnPDownload)","desc":"Defaults to false (downloads allowed) when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windowsProtectedPrintGroupPolicyState":{"name":"windowsProtectedPrintGroupPolicyState","type":"\u0004","title":"Whether Windows Protected Print mode is enabled (Printers\\WPP\\WindowsProtectedPrintGroupPolicyState). Null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Print Spooler security configuration","desc":"Hardening-relevant state of the Windows Print Spooler and printing subsystem. The fields are sourced from the Group Policy printer keys under HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers (and its PointAndPrint, RPC, IPP, and WPP subkeys), the machine-wide HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print key, and the spooler service start configuration under HKLM\\SYSTEM\\CurrentControlSet\\Services\\Spooler. These controls address the PrintNightmare and related spooler vulnerabilities: whether the service is disabled, whether remote RPC is accepted, and how Point-and-Print driver installation is restricted.  Integer settings that are not present in the registry resolve to null so \"not configured\" is distinguishable from an explicit value of 0 (important because several controls, for example registerRemoteRpcEndpoint == 0, are compliant precisely when set to 0). Boolean settings resolve to their documented Windows default when the value is absent.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.spooler.ipp":{"id":"windows.spooler.ipp","name":"windows.spooler.ipp","fields":{"blockCertCNInvalid":{"name":"blockCertCNInvalid","type":"\u0004","is_mandatory":true,"title":"Whether IPP rejects server certificates whose CN does not match (SecurityFlagsBlockCertCNInvalid)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"blockCertDateInvalid":{"name":"blockCertDateInvalid","type":"\u0004","is_mandatory":true,"title":"Whether IPP rejects expired or not-yet-valid server certificates (SecurityFlagsBlockCertDateInvalid)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"blockCertWrongUsage":{"name":"blockCertWrongUsage","type":"\u0004","is_mandatory":true,"title":"Whether IPP rejects server certificates used for the wrong purpose (SecurityFlagsBlockCertWrongUsage)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"blockUnknownCA":{"name":"blockUnknownCA","type":"\u0004","is_mandatory":true,"title":"Whether IPP rejects server certificates from an unknown CA (SecurityFlagsBlockUnknownCA)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"requireIpps":{"name":"requireIpps","type":"\u0004","is_mandatory":true,"title":"Whether IPP connections must use IPP over HTTPS (RequireIpps)","desc":"Defaults to false when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Print Spooler Internet Printing Protocol (IPP) settings","desc":"Certificate validation flags under HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\IPP. The boolean fields report whether each certificate check is enforced; they default to false (the check is not enforced) when the corresponding value is absent.","private":true,"min_provider_version":"13.29.1","defaults":"requireIpps","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.spooler.pointAndPrint":{"id":"windows.spooler.pointAndPrint","name":"windows.spooler.pointAndPrint","fields":{"noWarningNoElevationOnInstall":{"name":"noWarningNoElevationOnInstall","type":"\u0004","is_mandatory":true,"title":"Whether elevation/warning prompts are suppressed when installing a Point-and-Print driver (NoWarningNoElevationOnInstall)","desc":"The hardened state is false (the warning/elevation prompt is kept). Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"restrictDriverInstallationToAdministrators":{"name":"restrictDriverInstallationToAdministrators","type":"\u0004","is_mandatory":true,"title":"Whether printer driver installation is restricted to administrators (RestrictDriverInstallationToAdministrators)","desc":"Defaults to true (the hardened Windows default introduced by the PrintNightmare mitigations) when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"updatePromptSettings":{"name":"updatePromptSettings","type":"\u0005","is_mandatory":true,"title":"Whether to suppress elevation/warning prompts when updating a Point-and-Print driver (UpdatePromptSettings)","desc":"0 keeps the warning/elevation prompt (the hardened state). Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Print Spooler Point and Print restrictions","desc":"Settings under HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\PointAndPrint that govern how non-administrators may install printer drivers from a print server. Values are null when not configured.","private":true,"min_provider_version":"13.29.1","defaults":"restrictDriverInstallationToAdministrators","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.spooler.rpc":{"id":"windows.spooler.rpc","name":"windows.spooler.rpc","fields":{"authentication":{"name":"authentication","type":"\u0005","is_mandatory":true,"title":"RPC authentication requirement for incoming connections (RpcAuthentication)","desc":"1 = default, 2 = negotiate, 3 = none. Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"forceKerberos":{"name":"forceKerberos","type":"\u0004","is_mandatory":true,"title":"Whether Kerberos is required for incoming spooler RPC connections (ForceKerberosForRpc)","desc":"Defaults to false when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"protocols":{"name":"protocols","type":"\u0005","is_mandatory":true,"title":"Allowed RPC transport protocols bitmask (RpcProtocols)","desc":"5 allows RPC over TCP and named pipes; 7 adds local. Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"tcpPort":{"name":"tcpPort","type":"\u0005","is_mandatory":true,"title":"Fixed TCP port used for RPC over TCP, 0 for dynamic (RpcTcpPort)","desc":"Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"useNamedPipeProtocol":{"name":"useNamedPipeProtocol","type":"\u0004","is_mandatory":true,"title":"Whether the spooler allows RPC over named pipes in addition to TCP (RpcUseNamedPipeProtocol)","desc":"The hardened state is false (RPC over TCP only). Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Print Spooler RPC settings","desc":"Settings under HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\RPC that control the transport and authentication used for spooler RPC. Integer values are null when not configured.","private":true,"min_provider_version":"13.29.1","defaults":"authentication protocols","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.telemetry":{"id":"windows.telemetry","name":"windows.telemetry","fields":{"allowTelemetry":{"name":"allowTelemetry","type":"\u0005","title":"Diagnostic data level (DataCollection\\AllowTelemetry): 0=Security, 1=Basic/Required, 2=Enhanced, 3=Full. Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableCloudOptimizedContent":{"name":"disableCloudOptimizedContent","type":"\u0004","title":"Whether cloud-optimized content is disabled (CloudContent\\DisableCloudOptimizedContent)","desc":"Cloud-optimized content tailors suggestions using cloud data. Null when the policy is not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableConsumerAccountStateContent":{"name":"disableConsumerAccountStateContent","type":"\u0004","title":"Whether consumer account state content is disabled (CloudContent\\DisableConsumerAccountStateContent). Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableEnterpriseAuthProxy":{"name":"disableEnterpriseAuthProxy","type":"\u0004","title":"Whether the telemetry service may not use an authenticated proxy (DataCollection\\DisableEnterpriseAuthProxy)","desc":"Applies to the Connected User Experiences and Telemetry service. Null when the policy is not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableOneSettingsDownloads":{"name":"disableOneSettingsDownloads","type":"\u0004","title":"Whether downloading configuration from the OneSettings service is disabled (DataCollection\\DisableOneSettingsDownloads). Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableWindowsConsumerFeatures":{"name":"disableWindowsConsumerFeatures","type":"\u0004","title":"Whether Windows consumer features are disabled (CloudContent\\DisableWindowsConsumerFeatures)","desc":"Consumer features include app suggestions and consumer experiences. Null when the policy is not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"doNotShowFeedbackNotifications":{"name":"doNotShowFeedbackNotifications","type":"\u0004","title":"Whether feedback notifications are suppressed (DataCollection\\DoNotShowFeedbackNotifications)","desc":"When set, the user does not receive telemetry feedback notifications. Null when the policy is not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enableOneSettingsAuditing":{"name":"enableOneSettingsAuditing","type":"\u0004","title":"Whether auditing of OneSettings usage is enabled (DataCollection\\EnableOneSettingsAuditing). Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"limitDiagnosticLogCollection":{"name":"limitDiagnosticLogCollection","type":"\u0004","title":"Whether collection of diagnostic logs is limited (DataCollection\\LimitDiagnosticLogCollection). Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"limitDumpCollection":{"name":"limitDumpCollection","type":"\u0004","title":"Whether collection of crash dumps is limited (DataCollection\\LimitDumpCollection). Null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows diagnostic data (telemetry) and consumer cloud-content policy","desc":"Effective Windows privacy and telemetry posture read from the Group Policy keys HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection and HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent. These are GPO-only DWORD values. The diagnostic data level is a graded integer; the remaining settings are on/off booleans. Every field is nullable so that an absent value (the policy is not configured) is distinguishable from an explicit false or 0. Read from the registry, so it is available even on connections that cannot run commands.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.tpm":{"id":"windows.tpm","name":"windows.tpm","fields":{"activated":{"name":"activated","type":"\u0004","title":"Whether the TPM is activated","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","title":"Whether the TPM is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"manufacturerVersion":{"name":"manufacturerVersion","type":"\u0007","title":"TPM manufacturer version string","provider":"go.mondoo.com/cnquery/v9/providers/os"},"present":{"name":"present","type":"\u0004","title":"Whether a TPM is present on the system","provider":"go.mondoo.com/cnquery/v9/providers/os"},"ready":{"name":"ready","type":"\u0004","title":"Whether the TPM is ready for use","provider":"go.mondoo.com/cnquery/v9/providers/os"},"specVersion":{"name":"specVersion","type":"\u0007","title":"Major TPM specification version, for example \"2.0\"","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Trusted Platform Module (TPM)","desc":"Trusted Platform Module state: whether a TPM is present, ready for use, enabled, and activated, along with its major specification version and manufacturer version string. Presence and a 2.0 specification version are prerequisites for Windows 11 readiness and several BitLocker and device-health controls. On a system without a TPM the fields resolve cleanly (present is false) rather than erroring.","min_provider_version":"13.22.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.update":{"id":"windows.update","name":"windows.update","fields":{"available":{"name":"available","type":"\u0019\u001bwindows.update.entry","title":"Updates that are available but not yet installed","provider":"go.mondoo.com/cnquery/v9/providers/os"},"config":{"name":"config","type":"\u001bwindows.update.config","title":"Windows Update Agent configuration and freshness","provider":"go.mondoo.com/cnquery/v9/providers/os"},"entry":{"name":"entry","type":"\u001bwindows.update.entry","title":"Windows update record","desc":"Single update reported by the Windows Update Agent: the `kbId` (for example \"KB5034441\"), human-readable `title`, `classification` (such as \"Security Updates\", \"Critical Updates\", or \"Definition Updates\"), the support URL, and the `cveIds` it addresses. Installed updates carry the install `date` and `operation`; available updates carry the `severity` and whether they require a reboot. Filter `windows.update.available` on `severity` or `cveIds` to find outstanding security-relevant updates.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"installed":{"name":"installed","type":"\u0019\u001bwindows.update.entry","title":"Updates that have been installed (Windows Update Agent history)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"policy":{"name":"policy","type":"\u001bwindows.update.policy","title":"Windows Update for Business and Automatic Updates group policy configuration","desc":"Each policy value is nullable: a null value signals that the setting is not configured, distinguishing an absent policy from one explicitly set to 0.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Update Agent","desc":"How a Windows host receives updates and what it has applied or has pending. The `config` field surfaces Windows Update Agent configuration and freshness (the effective catalog source, WSUS settings, the last successful detection / download / install times, and whether a reboot is pending). `installed` lists the updates the agent has applied (the installed-KB history), and `available` lists updates the agent has found but not yet installed. Configuration is read from the registry and works even on connections that cannot run commands; the installed and available collections fall back to the Windows Update Agent COM API when commands are available.","min_provider_version":"13.20.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.update.config":{"id":"windows.update.config","name":"windows.update.config","fields":{"auOptions":{"name":"auOptions","type":"\u0005","is_mandatory":true,"title":"Automatic update behavior","desc":"The HKLM\\...\\AU\\AUOptions value: 1=keep my computer up to date disabled, 2=notify before download, 3=auto-download and notify of install, 4=auto-download and schedule install, 5=allow local admin to choose. 0 when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"catalogSource":{"name":"catalogSource","type":"\u0007","is_mandatory":true,"title":"Effective update catalog source","desc":"One of \"windowsUpdate\" (direct Microsoft Update), \"wsus\" (a configured WSUS server), \"windowsUpdateForBusiness\", \"disabled\" (the agent or automatic updates are turned off), or \"unknown\" (the relevant registry keys could not be read).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastDetectionError":{"name":"lastDetectionError","type":"\u0007","is_mandatory":true,"title":"Last detection error code (e.g., \"0x80244022\"); empty when the last detection succeeded","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastDetectionSuccess":{"name":"lastDetectionSuccess","type":"\t","is_mandatory":true,"title":"Time of the last successful update detection","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastDownloadSuccess":{"name":"lastDownloadSuccess","type":"\t","is_mandatory":true,"title":"Time of the last successful update download","provider":"go.mondoo.com/cnquery/v9/providers/os"},"lastInstallSuccess":{"name":"lastInstallSuccess","type":"\t","is_mandatory":true,"title":"Time of the last successful update install","provider":"go.mondoo.com/cnquery/v9/providers/os"},"policyState":{"name":"policyState","type":"\u0005","is_mandatory":true,"title":"Windows Update for Business policy state (HKLM\\SOFTWARE\\Microsoft\\WindowsUpdate\\UpdatePolicy\\PolicyState)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rebootPending":{"name":"rebootPending","type":"\u0004","is_mandatory":true,"title":"Whether a reboot is pending from a previous update","provider":"go.mondoo.com/cnquery/v9/providers/os"},"service":{"name":"service","type":"\u001bservice","title":"The Windows Update service (wuauserv)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"useWUServer":{"name":"useWUServer","type":"\u0004","is_mandatory":true,"title":"Whether the host is directed to use the WSUS server (HKLM\\...\\AU\\UseWUServer)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"wsusServerUrl":{"name":"wsusServerUrl","type":"\u0007","is_mandatory":true,"title":"Configured WSUS server URL (HKLM\\...\\WindowsUpdate\\WUServer)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"wsusStatusServerUrl":{"name":"wsusStatusServerUrl","type":"\u0007","is_mandatory":true,"title":"Configured WSUS status reporting server URL (HKLM\\...\\WindowsUpdate\\WUStatusServer)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Update Agent configuration and freshness","desc":"Where a Windows host gets its updates and whether the Windows Update Agent is healthy. `catalogSource` summarizes the effective source (\"windowsUpdate\", \"wsus\", \"windowsUpdateForBusiness\", \"disabled\", or \"unknown\"); `wsusServerUrl` / `useWUServer` reveal WSUS configuration; the `lastDetectionSuccess` / `lastDownloadSuccess` / `lastInstallSuccess` times expose how recently the agent refreshed its view; and `rebootPending` flags hosts waiting on a restart before update state can be trusted. Read from the Windows registry, so it is available even on connections that cannot run commands.","private":true,"min_provider_version":"13.20.1","defaults":"catalogSource rebootPending","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.update.entry":{"id":"windows.update.entry","name":"windows.update.entry","fields":{"categories":{"name":"categories","type":"\u0019\u0007","is_mandatory":true,"title":"Update categories reported by the Windows Update Agent","provider":"go.mondoo.com/cnquery/v9/providers/os"},"classification":{"name":"classification","type":"\u0007","is_mandatory":true,"title":"Update classification","desc":"Microsoft's update category, such as \"Security Updates\", \"Critical Updates\", \"Update Rollups\", \"Definition Updates\", \"Drivers\", or \"Feature Packs\". Empty when the agent does not report a category.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"cveIds":{"name":"cveIds","type":"\u0019\u0007","is_mandatory":true,"title":"CVE identifiers addressed by this update","provider":"go.mondoo.com/cnquery/v9/providers/os"},"date":{"name":"date","type":"\t","is_mandatory":true,"title":"Date the update was installed (installed updates only)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"kbId":{"name":"kbId","type":"\u0007","is_mandatory":true,"title":"Knowledge base article ID (e.g., \"KB5034441\"); empty for updates without a KB","provider":"go.mondoo.com/cnquery/v9/providers/os"},"operation":{"name":"operation","type":"\u0007","is_mandatory":true,"title":"Operation that produced this history entry (e.g., \"Installation\", \"Uninstallation\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rebootRequired":{"name":"rebootRequired","type":"\u0004","is_mandatory":true,"title":"Whether installing the update requires a reboot","provider":"go.mondoo.com/cnquery/v9/providers/os"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Microsoft severity rating for security updates (e.g., \"Critical\", \"Important\", \"Moderate\", \"Low\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"supportUrl":{"name":"supportUrl","type":"\u0007","is_mandatory":true,"title":"Vendor support or knowledge base URL","provider":"go.mondoo.com/cnquery/v9/providers/os"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Human-readable update title","provider":"go.mondoo.com/cnquery/v9/providers/os"},"updateId":{"name":"updateId","type":"\u0007","is_mandatory":true,"title":"Update identity (Windows Update Agent UpdateID GUID, or package name when read from the registry)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows update record","desc":"Single update reported by the Windows Update Agent: the `kbId` (for example \"KB5034441\"), human-readable `title`, `classification` (such as \"Security Updates\", \"Critical Updates\", or \"Definition Updates\"), the support URL, and the `cveIds` it addresses. Installed updates carry the install `date` and `operation`; available updates carry the `severity` and whether they require a reboot. Filter `windows.update.available` on `severity` or `cveIds` to find outstanding security-relevant updates.","private":true,"min_provider_version":"13.20.1","defaults":"kbId title classification","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.update.policy":{"id":"windows.update.policy","name":"windows.update.policy","fields":{"allowOptionalContent":{"name":"allowOptionalContent","type":"\u0005","is_mandatory":true,"title":"Enable optional updates / optional content (WindowsUpdate\\SetAllowOptionalContent); null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowTemporaryEnterpriseFeatureControl":{"name":"allowTemporaryEnterpriseFeatureControl","type":"\u0004","is_mandatory":true,"title":"Whether temporary enterprise feature control is allowed (WindowsUpdate\\AllowTemporaryEnterpriseFeatureControl); null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"automaticUpdatesEnabled":{"name":"automaticUpdatesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether automatic updates are configured and enabled (AU\\NoAutoUpdate is present and 0)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"deferFeatureUpdates":{"name":"deferFeatureUpdates","type":"\u0004","is_mandatory":true,"title":"Whether feature update deferral is enabled (WindowsUpdate\\DeferFeatureUpdates); null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"deferFeatureUpdatesPeriodInDays":{"name":"deferFeatureUpdatesPeriodInDays","type":"\u0005","is_mandatory":true,"title":"Number of days feature updates are deferred (WindowsUpdate\\DeferFeatureUpdatesPeriodInDays); null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"deferQualityUpdates":{"name":"deferQualityUpdates","type":"\u0004","is_mandatory":true,"title":"Whether quality update deferral is enabled (WindowsUpdate\\DeferQualityUpdates); null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"deferQualityUpdatesPeriodInDays":{"name":"deferQualityUpdatesPeriodInDays","type":"\u0005","is_mandatory":true,"title":"Number of days quality updates are deferred (WindowsUpdate\\DeferQualityUpdatesPeriodInDays); null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disablePauseUXAccess":{"name":"disablePauseUXAccess","type":"\u0004","is_mandatory":true,"title":"Whether access to pause updates is removed (WindowsUpdate\\SetDisablePauseUXAccess); null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"managePreviewBuilds":{"name":"managePreviewBuilds","type":"\u0005","is_mandatory":true,"title":"Manage preview builds (WindowsUpdate\\ManagePreviewBuildsPolicyValue)","desc":"0 = disable preview builds, 1 = enable, 2 = enable for next release; null when not configured.","provider":"go.mondoo.com/cnquery/v9/providers/os"},"noAutoRebootWithLoggedOnUsers":{"name":"noAutoRebootWithLoggedOnUsers","type":"\u0004","is_mandatory":true,"title":"Whether scheduled installations do not auto-restart while users are logged on (AU\\NoAutoRebootWithLoggedOnUsers); null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"noAutoUpdate":{"name":"noAutoUpdate","type":"\u0004","is_mandatory":true,"title":"Whether automatic updates are turned off (AU\\NoAutoUpdate); null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scheduledInstallDay":{"name":"scheduledInstallDay","type":"\u0005","is_mandatory":true,"title":"Scheduled install day (AU\\ScheduledInstallDay): 0 = every day, 1-7 = Sunday-Saturday; null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"scheduledInstallTime":{"name":"scheduledInstallTime","type":"\u0005","is_mandatory":true,"title":"Scheduled install time as the hour of day (AU\\ScheduledInstallTime), 0-23; null when not configured","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Update for Business and Automatic Updates group policy","desc":"Managed Windows Update policy as configured through group policy (the \"Windows Components \u003e Windows Update\" administrative templates). Every value is read directly from the registry under `HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate` and its `AU` subkey, so this resource works on any connection where the registry is readable, including filesystem scans. Integer fields mirror the underlying REG_DWORD policy values and are null when the corresponding policy is not configured, which lets checks tell \"explicitly set to 0\" apart from \"left at the default\".","private":true,"min_provider_version":"13.29.1","defaults":"automaticUpdatesEnabled noAutoUpdate scheduledInstallDay","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.winrm":{"id":"windows.winrm","name":"windows.winrm","fields":{"client":{"name":"client","type":"\u001bwindows.winrm.client","title":"WinRM client authentication and transport policy","provider":"go.mondoo.com/cnquery/v9/providers/os"},"service":{"name":"service","type":"\u001bwindows.winrm.service","title":"WinRM service authentication, transport, and listener policy","provider":"go.mondoo.com/cnquery/v9/providers/os"},"serviceStartMode":{"name":"serviceStartMode","type":"\u0005","title":"WinRM service start mode (Services\\WinRM\\Start)","desc":"The HKLM\\SYSTEM\\CurrentControlSet\\Services\\WinRM\\Start DWORD: 2=automatic, 3=manual, 4=disabled. Defaults to 3 (manual) when the value is absent.","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windows Remote Management (WinRM)","desc":"Effective WinRM (Windows Remote Management) policy posture for both the WinRM client and service, plus the WinRS remote shell setting and the WinRM service start mode. The client and service settings are read from the Group Policy key HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\WinRM; these are GPO-only values with no per-listener effective fallback, so when a value is absent the documented Windows default applies. `serviceStartMode` reflects HKLM\\SYSTEM\\CurrentControlSet\\Services\\WinRM\\Start. Read from the registry, so it is available even on connections that cannot run commands.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.winrm.client":{"id":"windows.winrm.client","name":"windows.winrm.client","fields":{"allowBasic":{"name":"allowBasic","type":"\u0004","is_mandatory":true,"title":"Whether the WinRM client allows Basic authentication (Client\\AllowBasic)","desc":"Defaults to true (Windows historically allows Basic auth on the client when the policy is not configured).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowDigest":{"name":"allowDigest","type":"\u0004","is_mandatory":true,"title":"Whether the WinRM client allows Digest authentication (Client\\AllowDigest)","desc":"Defaults to true (Digest authentication is enabled on the client when the policy is not configured).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowUnencryptedTraffic":{"name":"allowUnencryptedTraffic","type":"\u0004","is_mandatory":true,"title":"Whether the WinRM client allows unencrypted traffic (Client\\AllowUnencryptedTraffic)","desc":"Defaults to true (Windows historically allows unencrypted traffic on the client when the policy is not configured).","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"WinRM client policy","desc":"WinRM client policy under HKLM\\SOFTWARE\\Policies\\Microsoft \\Windows\\WinRM\\Client. These are GPO-only values; when a value is absent the documented Windows default applies.","private":true,"min_provider_version":"13.29.1","defaults":"allowBasic allowUnencryptedTraffic","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windows.winrm.service":{"id":"windows.winrm.service","name":"windows.winrm.service","fields":{"allowAutoConfig":{"name":"allowAutoConfig","type":"\u0004","is_mandatory":true,"title":"Whether the WinRM service allows remote server management / auto config (Service\\AllowAutoConfig)","desc":"Defaults to false (the listener is not auto-configured when the policy is not configured).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowBasic":{"name":"allowBasic","type":"\u0004","is_mandatory":true,"title":"Whether the WinRM service allows Basic authentication (Service\\AllowBasic)","desc":"Defaults to true (Windows historically allows Basic auth on the service when the policy is not configured).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowRemoteShellAccess":{"name":"allowRemoteShellAccess","type":"\u0004","is_mandatory":true,"title":"Whether WinRS allows remote shell access (Service\\WinRS\\AllowRemoteShellAccess)","desc":"Defaults to true (remote shell access is allowed when the policy is not configured).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"allowUnencryptedTraffic":{"name":"allowUnencryptedTraffic","type":"\u0004","is_mandatory":true,"title":"Whether the WinRM service allows unencrypted traffic (Service\\AllowUnencryptedTraffic)","desc":"Defaults to true (Windows historically allows unencrypted traffic on the service when the policy is not configured).","provider":"go.mondoo.com/cnquery/v9/providers/os"},"disableRunAs":{"name":"disableRunAs","type":"\u0004","is_mandatory":true,"title":"Whether the WinRM service disallows storing RunAs credentials (Service\\DisableRunAs)","desc":"Defaults to false (RunAs credential storage is not disabled when the policy is not configured).","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"WinRM service policy","desc":"WinRM service policy under HKLM\\SOFTWARE\\Policies\\Microsoft \\Windows\\WinRM\\Service (and the WinRS subkey). These are GPO-only values; when a value is absent the documented Windows default applies.","private":true,"min_provider_version":"13.29.1","defaults":"allowBasic allowUnencryptedTraffic","provider":"go.mondoo.com/cnquery/v9/providers/os"},"windsurf":{"id":"windsurf","name":"windsurf","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Windsurf configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mcpServer":{"name":"mcpServer","type":"\u001bwindsurf.mcpServer","title":"Windsurf MCP server configuration","desc":"Model Context Protocol server Windsurf is configured to use. The command and args launch the server to expose external tools and data to the assistant, and hasEnv reports whether environment variables (often holding API keys or tokens) are configured for it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"mcpServers":{"name":"mcpServers","type":"\u0019\u001bwindsurf.mcpServer","title":"MCP servers the editor connects to","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"rule":{"name":"rule","type":"\u001bwindsurf.rule","title":"Windsurf rule / memory file","desc":"Rule or memory file that injects standing instructions into the Windsurf assistant's context. The content field holds the full text, which shapes how the AI behaves and is worth reviewing for injected or unexpected directives.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"rules":{"name":"rules","type":"\u0019\u001bwindsurf.rule","title":"Global rules and memories that steer the assistant","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional, null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"skill":{"name":"skill","type":"\u001bwindsurf.skill","title":"Windsurf skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the assistant. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true,"maturity":"preview"},"skills":{"name":"skills","type":"\u0019\u001bwindsurf.skill","title":"Installed skills","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Windsurf editor (Codeium) instance","desc":"Windsurf AI code editor from Codeium installed on the host. Queryable through it are the global rules and memories that steer the assistant, the configured MCP servers, and any installed skills, along with the package that installed the editor and the runtime it executes in. URL: https://windsurf.com/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"windsurf.mcpServer":{"id":"windsurf.mcpServer","name":"windsurf.mcpServer","fields":{"args":{"name":"args","type":"\u0019\u0007","is_mandatory":true,"title":"Command-line arguments passed to the server command","provider":"go.mondoo.com/cnquery/v9/providers/os"},"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Local command launched for the server","provider":"go.mondoo.com/cnquery/v9/providers/os"},"hasEnv":{"name":"hasEnv","type":"\u0004","is_mandatory":true,"title":"Whether environment variables (for example API keys) are configured","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Server name","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windsurf MCP server configuration","desc":"Model Context Protocol server Windsurf is configured to use. The command and args launch the server to expose external tools and data to the assistant, and hasEnv reports whether environment variables (often holding API keys or tokens) are configured for it.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"windsurf.rule":{"id":"windsurf.rule","name":"windsurf.rule","fields":{"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full content of the rule file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name (derived from filename)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Path to the rule file","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windsurf rule / memory file","desc":"Rule or memory file that injects standing instructions into the Windsurf assistant's context. The content field holds the full text, which shapes how the AI behaves and is worth reviewing for injected or unexpected directives.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"windsurf.skill":{"id":"windsurf.skill","name":"windsurf.skill","fields":{"allowedTools":{"name":"allowedTools","type":"\u0019\u0007","is_mandatory":true,"title":"Tools the skill is allowed to use","provider":"go.mondoo.com/cnquery/v9/providers/os"},"argumentHint":{"name":"argumentHint","type":"\u0007","is_mandatory":true,"title":"Hint describing the skill's expected arguments","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Full markdown content of the skill definition","provider":"go.mondoo.com/cnquery/v9/providers/os"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Skill description","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Skill name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sha256":{"name":"sha256","type":"\u0007","title":"SHA-256 hash of the skill content, for integrity checks","provider":"go.mondoo.com/cnquery/v9/providers/os"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Path to the SKILL.md file that defines the skill","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Windsurf skill","desc":"Skill defined by a SKILL.md file that packages task instructions for the assistant. The allowedTools list bounds which tools the skill may invoke, argumentHint documents its expected arguments, and content holds the full definition. Use sha256 to detect tampering.","private":true,"min_provider_version":"13.13.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"wordpress":{"id":"wordpress","fields":{"package":{"name":"package","type":"\u001bwordpress.package","title":"WordPress plugin","desc":"Single installed WordPress plugin, exposing its slug, display name, version, license, and the minimum required and maximum tested WordPress versions declared in its header.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"packages":{"name":"packages","type":"\u001bwordpress.packages","title":"WordPress plugin inventory","desc":"WordPress plugins installed under wp-content/plugins/, each with its version and supported WordPress version range. Useful for spotting plugins that are untested against the running WordPress version. Set `path` to the plugins directory.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true}},"is_extension":true},"wordpress.package":{"id":"wordpress.package","name":"wordpress.package","fields":{"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Plugin display name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","is_mandatory":true,"title":"Files that contributed this plugin to the inventory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"license":{"name":"license","type":"\u0007","is_mandatory":true,"title":"License","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Plugin slug (directory name)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"purl":{"name":"purl","type":"\u0007","is_mandatory":true,"title":"Package URL (purl), a standardized identifier for the plugin","provider":"go.mondoo.com/cnquery/v9/providers/os"},"requiresWp":{"name":"requiresWp","type":"\u0007","is_mandatory":true,"title":"Minimum required WordPress version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"testedUpTo":{"name":"testedUpTo","type":"\u0007","is_mandatory":true,"title":"Maximum tested WordPress version","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Plugin version (from Stable tag)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"WordPress plugin","desc":"Single installed WordPress plugin, exposing its slug, display name, version, license, and the minimum required and maximum tested WordPress versions declared in its header.","private":true,"min_provider_version":"13.12.1","defaults":"name version purl","provider":"go.mondoo.com/cnquery/v9/providers/os"},"wordpress.packages":{"id":"wordpress.packages","name":"wordpress.packages","fields":{"files":{"name":"files","type":"\u0019\u001bpkgFileInfo","title":"Files used to determine the packages","provider":"go.mondoo.com/cnquery/v9/providers/os"},"list":{"name":"list","type":"\u0019\u001bwordpress.package","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to WordPress plugins directory (wp-content/plugins/)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007","optional":true}]},"list_type":"\u001bwordpress.package","title":"WordPress plugin inventory","desc":"WordPress plugins installed under wp-content/plugins/, each with its version and supported WordPress version range. Useful for spotting plugins that are untested against the running WordPress version. Set `path` to the plugins directory.","min_provider_version":"13.12.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"yum":{"id":"yum","name":"yum","fields":{"config":{"name":"config","type":"\u001byum.config","title":"Yum/DNF global configuration","desc":"System-wide package manager configuration: the `[main]` section of `/etc/yum.conf`, or `/etc/dnf/dnf.conf` on dnf-based systems. Use `gpgcheck` and `localPkgGpgcheck` to assert that package signature verification is enforced for every repository and for locally installed packages, a core CIS supply-chain control; `repoGpgcheck` extends that to repository metadata. The bool accessors reflect the explicit directive and are `false` when the directive is absent. `params` exposes every `[main]` directive as a raw string map for settings without a dedicated accessor. Select an alternate file with `yum.config(path: \"...\")`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"repo":{"name":"repo","type":"\u001byum.repo","title":"Yum repository","desc":"A single configured yum/dnf repository as reported by `yum -v repolist all`: its `id`, human-readable `name`, `status`, `baseurl` list, expiry indicator, backing configuration `file`, `revision`, package count, size, mirror list, and whether it is currently `enabled`. Select a repository by ID, for example `yum.repo(id: \"baseos\")`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"repos":{"name":"repos","type":"\u0019\u001byum.repo","title":"List of all configured Yum repositories","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vars":{"name":"vars","type":"\u001a\u0007\u0007","title":"Variables defined in Yum configuration files (/etc/yum.conf and all .repo files in the /etc/yum.repos.d/)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"Yum/DNF package manager","desc":"Configuration of the yum/dnf package manager on RedHat-family systems. `vars` exposes the variables defined across `/etc/yum.conf` and the `.repo` files (for example `$releasever` and `$basearch`) and `repos` lists every configured repository as `yum.repo` entries.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"yum.config":{"id":"yum.config","name":"yum.config","fields":{"cleanRequirementsOnRemove":{"name":"cleanRequirementsOnRemove","type":"\u0004","refs":["\"params\""],"title":"Whether dependencies are removed along with packages (clean_requirements_on_remove)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"content":{"name":"content","type":"\u0007","refs":["\"file\""],"title":"Raw contents of the configuration file","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","title":"File backing the [main] configuration section","provider":"go.mondoo.com/cnquery/v9/providers/os"},"gpgcheck":{"name":"gpgcheck","type":"\u0004","refs":["\"params\""],"title":"Whether package signature checking is enforced globally (gpgcheck)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"localPkgGpgcheck":{"name":"localPkgGpgcheck","type":"\u0004","refs":["\"params\""],"title":"Whether signature checking is enforced for local packages (localpkg_gpgcheck)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"params":{"name":"params","type":"\u001a\u0007\u0007","refs":["\"content\""],"title":"Every [main] section directive as key/value strings","provider":"go.mondoo.com/cnquery/v9/providers/os"},"repoGpgcheck":{"name":"repoGpgcheck","type":"\u0004","refs":["\"params\""],"title":"Whether repository metadata signature checking is enforced (repo_gpgcheck)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"Yum/DNF global configuration","desc":"System-wide package manager configuration: the `[main]` section of `/etc/yum.conf`, or `/etc/dnf/dnf.conf` on dnf-based systems. Use `gpgcheck` and `localPkgGpgcheck` to assert that package signature verification is enforced for every repository and for locally installed packages, a core CIS supply-chain control; `repoGpgcheck` extends that to repository metadata. The bool accessors reflect the explicit directive and are `false` when the directive is absent. `params` exposes every `[main]` directive as a raw string map for settings without a dedicated accessor. Select an alternate file with `yum.config(path: \"...\")`.","min_provider_version":"13.22.2","provider":"go.mondoo.com/cnquery/v9/providers/os"},"yum.repo":{"id":"yum.repo","name":"yum.repo","fields":{"baseurl":{"name":"baseurl","type":"\u0019\u0007","is_mandatory":true,"title":"URL where the repodata directory of a repository is located","provider":"go.mondoo.com/cnquery/v9/providers/os"},"enabled":{"name":"enabled","type":"\u0004","title":"Whether the repository is used as a package source (status is enabled)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"expire":{"name":"expire","type":"\u0007","is_mandatory":true,"title":"Indicator when the repository metadata will expire","provider":"go.mondoo.com/cnquery/v9/providers/os"},"file":{"name":"file","type":"\u001bfile","is_mandatory":true,"title":"Repository configuration file path","provider":"go.mondoo.com/cnquery/v9/providers/os"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Repository ID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mirrors":{"name":"mirrors","type":"\u0007","is_mandatory":true,"title":"Mirrors for this repository","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Human-readable repository name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pkgs":{"name":"pkgs","type":"\u0007","is_mandatory":true,"title":"Number of packages available from the repository","provider":"go.mondoo.com/cnquery/v9/providers/os"},"revision":{"name":"revision","type":"\u0007","is_mandatory":true,"title":"Repository revision","provider":"go.mondoo.com/cnquery/v9/providers/os"},"size":{"name":"size","type":"\u0007","is_mandatory":true,"title":"Total size of the repository","provider":"go.mondoo.com/cnquery/v9/providers/os"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Repository status (e.g., enabled or disabled)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"id","type":"\u0007"}]},"title":"Yum repository","desc":"A single configured yum/dnf repository as reported by `yum -v repolist all`: its `id`, human-readable `name`, `status`, `baseurl` list, expiry indicator, backing configuration `file`, `revision`, package count, size, mirror list, and whether it is currently `enabled`. Select a repository by ID, for example `yum.repo(id: \"baseos\")`.","min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"zed":{"id":"zed","name":"zed","fields":{"configPath":{"name":"configPath","type":"\u0007","is_mandatory":true,"title":"Path to the Zed configuration directory","provider":"go.mondoo.com/cnquery/v9/providers/os"},"extensions":{"name":"extensions","type":"\u0019\u0007","title":"Names of installed extensions","provider":"go.mondoo.com/cnquery/v9/providers/os"},"package":{"name":"package","type":"\u001bpackage","title":"Package that installed this tool","desc":"Resolves to the system-package-manager entry that installed the tool when one can be identified; otherwise an abstract package (origin \"unknown\", empty format, absent from `packages`) that records the tool's presence and, where determinable, an inferred version. Read `.installed` for the install signal, or any package field (`version`, `purl`, `vendor`) for detail.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"runtime":{"name":"runtime","type":"\u001bextensionRuntime","title":"Host the agent runs in","desc":"The environment the agent runs inside: the operating system for a standalone agent, the IDE/editor for an editor plugin, or the browser for a browser extension. The runtime's `package` carries the host's software identity (version and purl where known) so its own version and vulnerabilities can be looked up like any other software. Optional, null when the host cannot be determined.","min_provider_version":"13.33.1","provider":"go.mondoo.com/cnquery/v9/providers/os"},"settings":{"name":"settings","type":"\n","title":"Full settings dictionary parsed from the Zed configuration","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"configPath","type":"\u0007","optional":true}]},"title":"Zed editor instance","desc":"Zed code editor installed on the host. Queryable through it are the workspace settings dictionary and the names of installed extensions, along with the package that installed the editor and the runtime it executes in. URL: https://zed.dev/","min_provider_version":"13.13.1","defaults":"configPath","provider":"go.mondoo.com/cnquery/v9/providers/os","maturity":"preview"},"zfs":{"id":"zfs","name":"zfs","fields":{"dataset":{"name":"dataset","type":"\u001bzfs.dataset","title":"ZFS dataset (filesystem, volume, snapshot, or bookmark)","desc":"Single ZFS dataset: full `name`, `type` (filesystem, volume, snapshot, bookmark), used/available/referenced bytes, `mountpoint`, compression algorithm and ratio, `mounted` flag, record size, quota, reservation, `origin` snapshot for clones, creation time, encryption algorithm, full `properties` map, and `snapshots` list. Initialize by name or iterate from `zfs.datasets`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"datasets":{"name":"datasets","type":"\u0019\u001bzfs.dataset","title":"All ZFS datasets (filesystems, volumes, snapshots, bookmarks)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"pool":{"name":"pool","type":"\u001bzfs.pool","title":"ZFS storage pool","desc":"Single ZFS storage pool: `name`, `guid`, health status, total/allocated/free bytes, fragmentation percentage, space utilization, deduplication ratio, read-only flag, auto-expand/replace/trim settings, the top-level `vdevs` topology, and the full `properties` map. Initialize by name (e.g., `zfs.pool(name: \"tank\")`) or iterate from `zfs.pools`.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"pools":{"name":"pools","type":"\u0019\u001bzfs.pool","title":"ZFS storage pools","provider":"go.mondoo.com/cnquery/v9/providers/os"},"version":{"name":"version","type":"\u0007","title":"ZFS version string","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"ZFS storage pools and datasets","desc":"ZFS storage on the host: the installed `version`, the storage `pools` with their health and capacity, and every `dataset` (filesystems, volumes, snapshots, and bookmarks). Iterate to audit pool health, free capacity, vdev topology, and dataset properties such as compression and encryption.","min_provider_version":"13.1.2","defaults":"pools","provider":"go.mondoo.com/cnquery/v9/providers/os"},"zfs.dataset":{"id":"zfs.dataset","name":"zfs.dataset","fields":{"availableBytes":{"name":"availableBytes","type":"\u0005","is_mandatory":true,"title":"Available space in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"compression":{"name":"compression","type":"\u0007","is_mandatory":true,"title":"Compression algorithm (off, lz4, gzip, zstd, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"compressratio":{"name":"compressratio","type":"\u0006","is_mandatory":true,"title":"Compression ratio","provider":"go.mondoo.com/cnquery/v9/providers/os"},"creation":{"name":"creation","type":"\t","is_mandatory":true,"title":"Creation time","provider":"go.mondoo.com/cnquery/v9/providers/os"},"encryption":{"name":"encryption","type":"\u0007","is_mandatory":true,"title":"Encryption algorithm (off, aes-256-gcm, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mounted":{"name":"mounted","type":"\u0004","is_mandatory":true,"title":"Whether the dataset is currently mounted","provider":"go.mondoo.com/cnquery/v9/providers/os"},"mountpoint":{"name":"mountpoint","type":"\u0007","is_mandatory":true,"title":"Mount point (empty for volumes/snapshots)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Full dataset name (pool/path or pool/path@snap)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"origin":{"name":"origin","type":"\u0007","is_mandatory":true,"title":"Origin snapshot (for clones, empty otherwise)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"properties":{"name":"properties","type":"\u001a\u0007\u0007","title":"All dataset properties reported by \"zfs get all\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"quotaBytes":{"name":"quotaBytes","type":"\u0005","is_mandatory":true,"title":"Quota in bytes (0 = none)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"recordsizeBytes":{"name":"recordsizeBytes","type":"\u0005","is_mandatory":true,"title":"Record size in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"referencedBytes":{"name":"referencedBytes","type":"\u0005","is_mandatory":true,"title":"Referenced space in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"reservationBytes":{"name":"reservationBytes","type":"\u0005","is_mandatory":true,"title":"Reservation in bytes (0 = none)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"snapshots":{"name":"snapshots","type":"\u0019\u001bzfs.dataset","title":"Snapshots of this dataset","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Dataset type (filesystem, volume, snapshot, bookmark)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"usedBytes":{"name":"usedBytes","type":"\u0005","is_mandatory":true,"title":"Used space in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"ZFS dataset (filesystem, volume, snapshot, or bookmark)","desc":"Single ZFS dataset: full `name`, `type` (filesystem, volume, snapshot, bookmark), used/available/referenced bytes, `mountpoint`, compression algorithm and ratio, `mounted` flag, record size, quota, reservation, `origin` snapshot for clones, creation time, encryption algorithm, full `properties` map, and `snapshots` list. Initialize by name or iterate from `zfs.datasets`.","min_provider_version":"13.1.2","defaults":"name type usedBytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"zfs.pool":{"id":"zfs.pool","name":"zfs.pool","fields":{"allocatedBytes":{"name":"allocatedBytes","type":"\u0005","is_mandatory":true,"title":"Allocated space in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"autoexpand":{"name":"autoexpand","type":"\u0004","is_mandatory":true,"title":"Whether auto-expand is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"autoreplace":{"name":"autoreplace","type":"\u0004","is_mandatory":true,"title":"Whether auto-replace is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"autotrim":{"name":"autotrim","type":"\u0004","is_mandatory":true,"title":"Whether auto-trim is enabled","provider":"go.mondoo.com/cnquery/v9/providers/os"},"dedupratio":{"name":"dedupratio","type":"\u0006","is_mandatory":true,"title":"Deduplication ratio","provider":"go.mondoo.com/cnquery/v9/providers/os"},"fragmentation":{"name":"fragmentation","type":"\u0005","is_mandatory":true,"title":"Fragmentation percentage","provider":"go.mondoo.com/cnquery/v9/providers/os"},"freeBytes":{"name":"freeBytes","type":"\u0005","is_mandatory":true,"title":"Free space in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"guid":{"name":"guid","type":"\u0007","is_mandatory":true,"title":"Pool GUID","provider":"go.mondoo.com/cnquery/v9/providers/os"},"health":{"name":"health","type":"\u0007","is_mandatory":true,"title":"Health status (ONLINE, DEGRADED, FAULTED, OFFLINE, REMOVED, UNAVAIL)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Pool name","provider":"go.mondoo.com/cnquery/v9/providers/os"},"percentUsed":{"name":"percentUsed","type":"\u0005","is_mandatory":true,"title":"Percentage of pool space used (0-100)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"properties":{"name":"properties","type":"\u001a\u0007\u0007","title":"All pool properties reported by \"zpool get all\"","provider":"go.mondoo.com/cnquery/v9/providers/os"},"readonly":{"name":"readonly","type":"\u0004","is_mandatory":true,"title":"Whether the pool is read-only","provider":"go.mondoo.com/cnquery/v9/providers/os"},"sizeBytes":{"name":"sizeBytes","type":"\u0005","is_mandatory":true,"title":"Total size in bytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"vdev":{"name":"vdev","type":"\u001bzfs.pool.vdev","title":"ZFS virtual device (vdev) in a pool's topology","desc":"Single vdev within a pool: its `name` (e.g., \"raidz2-0\", \"mirror-0\"), `type`, `state`, device `path` (for leaf vdevs), read/write/checksum error counts, slow I/O count, number of child devices, and the nested `devices` list. Nonzero error counts or a non-ONLINE `state` indicate a failing device.","provider":"go.mondoo.com/cnquery/v9/providers/os","is_implicit_resource":true},"vdevs":{"name":"vdevs","type":"\u0019\u001bzfs.pool.vdev","title":"Top-level virtual device groups (mirrors, raidz, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"ZFS storage pool","desc":"Single ZFS storage pool: `name`, `guid`, health status, total/allocated/free bytes, fragmentation percentage, space utilization, deduplication ratio, read-only flag, auto-expand/replace/trim settings, the top-level `vdevs` topology, and the full `properties` map. Initialize by name (e.g., `zfs.pool(name: \"tank\")`) or iterate from `zfs.pools`.","min_provider_version":"13.1.2","defaults":"name health sizeBytes","provider":"go.mondoo.com/cnquery/v9/providers/os"},"zfs.pool.vdev":{"id":"zfs.pool.vdev","name":"zfs.pool.vdev","fields":{"checksumErrors":{"name":"checksumErrors","type":"\u0005","is_mandatory":true,"title":"Checksum error count","provider":"go.mondoo.com/cnquery/v9/providers/os"},"devices":{"name":"devices","type":"\u0019\u001bzfs.pool.vdev","is_mandatory":true,"title":"Child vdevs/devices","provider":"go.mondoo.com/cnquery/v9/providers/os"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Vdev name (e.g., \"raidz2-0\", \"mirror-0\", \"sda\")","provider":"go.mondoo.com/cnquery/v9/providers/os"},"numDevices":{"name":"numDevices","type":"\u0005","is_mandatory":true,"title":"Number of child devices","provider":"go.mondoo.com/cnquery/v9/providers/os"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Device path (for leaf vdevs, empty for groups)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"readErrors":{"name":"readErrors","type":"\u0005","is_mandatory":true,"title":"Read error count","provider":"go.mondoo.com/cnquery/v9/providers/os"},"slowIos":{"name":"slowIos","type":"\u0005","is_mandatory":true,"title":"Slow I/O count","provider":"go.mondoo.com/cnquery/v9/providers/os"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Vdev state (ONLINE, DEGRADED, FAULTED, OFFLINE, REMOVED, UNAVAIL)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Vdev type (mirror, raidz, raidz2, raidz3, disk, file, draid, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/os"},"writeErrors":{"name":"writeErrors","type":"\u0005","is_mandatory":true,"title":"Write error count","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"title":"ZFS virtual device (vdev) in a pool's topology","desc":"Single vdev within a pool: its `name` (e.g., \"raidz2-0\", \"mirror-0\"), `type`, `state`, device `path` (for leaf vdevs), read/write/checksum error counts, slow I/O count, number of child devices, and the nested `devices` list. Nonzero error counts or a non-ONLINE `state` indicate a failing device.","min_provider_version":"13.1.2","defaults":"name type state numDevices","provider":"go.mondoo.com/cnquery/v9/providers/os"}},"dependencies":{"network":{"id":"go.mondoo.com/mql/v13/providers/network","name":"network"}}}